feat(firmware): v0.6.7-esp32 — real LP-core program + C6 soft-AP HE/TWT helper

ADR-110 P9 — software-only unblocks for the WITNESS-LOG-110 §B
hardware-blocked items. Two new modules, both default-off so v0.6.6 fleets
see no behavior change.

LP-core (B4 path):
- New firmware/esp32-csi-node/main/lp_core/main.c: real RISC-V LP-core
  motion-gate program with debounce + monotonic motion_count counter.
- c6_lp_core.c rewritten to load + run the LP binary via ulp_lp_core_run
  when CONFIG_C6_LP_CORE_ENABLE=y; falls back to the v0.6.6 ext1 GPIO-wake
  path otherwise (keeps regression surface small).
- ulp_embed_binary() wired in main/CMakeLists.txt, gated on the Kconfig.
- New Kconfig knobs: C6_LP_POLL_PERIOD_US (default 10 ms),
  C6_LP_DEBOUNCE_SAMPLES (default 3).
- Exposes c6_lp_core_motion_count() / c6_lp_core_poll_count() for the
  witness harness — once an INA/Joulescope is on the bench, B4 is one
  capture away from a measured number.

Soft-AP HE (B1/B2 unblock):
- New c6_softap_he.{h,c}: brings up the C6 in AP+STA mode with WPA2-PSK
  + HE advertisement, so a second C6 in STA mode can negotiate real
  iTWT against a known-cooperative AP without buying an 11ax router.
- main.c calls c6_softap_he_start() right before esp_wifi_start() when
  CONFIG_C6_SOFTAP_HE_ENABLE=y.
- New Kconfig knobs: C6_SOFTAP_HE_{SSID,PSK,CHANNEL} with NVS overrides
  via softap_ssid / softap_psk / softap_chan in the ruview namespace.

Build artifacts (IDF v5.4, both green, RC=0):
- S3 8 MB: 1093 KB (47% partition slack)
- C6 4 MB: 1019 KB (45% partition slack)
- SHA-256 sums in dist/firmware-v0.6.7/SHA256SUMS.txt

Doc updates: CHANGELOG wave-3 entry, ADR-110 phase table gets P5
upgrade note + new P9 row, WITNESS-LOG-110 gets new A0 section
recording the v0.6.7 build evidence.

Co-Authored-By: claude-flow <ruv@ruv.net>

firmware/esp32-csi-node/main/Kconfig.projbuild

@@ -352,6 +352,56 @@ menu "ESP32-C6 capabilities (ADR-110)"
         default y
         depends on C6_LP_CORE_ENABLE
 
+    config C6_LP_POLL_PERIOD_US
+        int "LP-core poll period (microseconds)"
+        default 10000
+        range 1000 1000000
+        depends on C6_LP_CORE_ENABLE
+        help
+            How often the LP-core program reads the wake GPIO.
+            10000 µs = 100 Hz. Lower values give faster response
+            but increase the average LP-core duty cycle (and
+            current). 10 ms is a good balance for PIR sensors.
+
+    config C6_LP_DEBOUNCE_SAMPLES
+        int "LP-core debounce sample count"
+        default 3
+        range 1 32
+        depends on C6_LP_CORE_ENABLE
+        help
+            How many consecutive matching GPIO reads are required
+            before the LP-core wakes the HP core. 3 = ~30 ms at the
+            default 10 ms poll period.
+
+    config C6_SOFTAP_HE_ENABLE
+        bool "Run as Wi-Fi 6 soft-AP with TWT Responder (two-board bench)"
+        default n
+        depends on SOC_WIFI_HE_SUPPORT
+        help
+            When set, the C6 starts in AP+STA mode and advertises a
+            soft-AP that announces HE (Wi-Fi 6) capability with
+            TWT Responder=1. Lets a second C6 station-mode board
+            negotiate a real iTWT agreement against a known-cooperative
+            AP, unblocking ADR-110 §B1/B2 measurement without
+            buying an 11ax router. SSID/PSK configured via NVS
+            (keys `softap_ssid` / `softap_psk`) or the defaults below.
+
+    config C6_SOFTAP_HE_SSID
+        string "Soft-AP SSID (when C6_SOFTAP_HE_ENABLE)"
+        default "ruview-c6-twt"
+        depends on C6_SOFTAP_HE_ENABLE
+
+    config C6_SOFTAP_HE_PSK
+        string "Soft-AP WPA2 password (>= 8 chars)"
+        default "ruviewtwt"
+        depends on C6_SOFTAP_HE_ENABLE
+
+    config C6_SOFTAP_HE_CHANNEL
+        int "Soft-AP channel (1-13)"
+        default 6
+        range 1 13
+        depends on C6_SOFTAP_HE_ENABLE
+
 endmenu
 
 menu "ADR-018 frame extensions (ADR-110)"