fix(firmware): C6 IDF v5.5 guard + HE-LTF host ingest + WITNESS-LOG-110 B1 resolution (#1005) (#1011)

* fix(firmware): c6_sync_espnow IDF v5.5 send-callback guard + B1 HE-LTF resolution (#1005)

Espressif backported the esp_now_send_cb_t signature change to v5.5
(esp_now_send_info_t = wifi_tx_info_t there), so the #944 guard must be
ESP_IDF_VERSION >= VAL(5,5,0), not MAJOR >= 6.

Validated on this repo's hardware toolchain:
- WITHOUT fix, IDF v5.5.2 esp32c6 build fails with the reporter's exact
  incompatible-pointer error at c6_sync_espnow.c:199 (reproduced)
- WITH fix, clean build on IDF v5.5.2 (esp32c6) AND IDF v5.4 (regression)

Docs: WITNESS-LOG-110 §B1 marked RESOLVED WITH MEASUREMENT (external,
@stuinfla, issue #1005): IDF v5.4 driver downconverts HE->HT; v5.5.2
delivers true HE-LTF (532B / 256 bins / 242 tones, PPDU 0x01 HE-SU).
ADR-110 capability table updated accordingly.

Co-Authored-By: claude-flow <ruv@ruv.net>

* docs: WITNESS-LOG-110 §B1 — in-house HE-LTF replication on the original COM12 C6

84% of 1,525 frames at 532B/PPDU 0x01 (HE-SU) with IDF v5.5.2 + the #1005
guard fix, AP ruv.net 11ax 2.4GHz. Two independent rigs now confirm:
v5.4 downconverts, v5.5.2 delivers 242-tone HE20.

Co-Authored-By: claude-flow <ruv@ruv.net>

* fix(host): 256-bin HE-LTF ingest end-to-end + latent offset bugs (#1005)

Audit of every ADR-018 consumer against live C6 HE20 frames (532B/256-bin):
- sensing-server + CLI calibrate parsers read n_subcarriers from one byte
  (256 decoded as 0) with stale seq/rssi offsets (rssi always 0 — latent,
  pre-existing, confirmed vs firmware csi_collector.c). Fixed to the real
  ADR-018 layout; n_subcarriers u8->u16; byte 18 surfaced as typed PpduType.
- sensing-server probe buffer 256B -> 2048B (532B datagram errored on Windows)
- per-node grid gate: lock densest (n_subcarriers, ppdu_type) grid, re-warm
  on upgrade, skip sparser minority frames — HT-64 never mixes into an
  HE-256 baseline window
- hardware parser: HE-aware bandwidth classification (256-FFT HE20 = 20MHz,
  was Bw160); PpduType/Adr018Flags re-exported
- verbatim live frames (532B HE-SU, 148B HT) embedded as regression fixtures
- archive python parser: bandwidth heuristic mirror fix

Live-validated: calibrate --tier he20 consumed 600x 256-bin frames into an
ADR-135 He20 baseline (242 tones) skipping 94 HT frames; sensing-server
shows node 12 active with real RSSI (-40dBm). 765 tests green across the
three crates; workspace check clean; Python proof PASS.

Co-Authored-By: claude-flow <ruv@ruv.net>

* test(fuzz): esp_netif/ping_sock/ip_addr stubs — un-break ADR-061 fuzz build after #954

csi_collector.c gained esp_netif.h / ping/ping_sock.h / lwip/ip_addr.h
includes for the #954 gateway self-ping; the host-fuzz stub env lacked
them, breaking the fuzz build on main since 5789351b7. Stubs return
no-gateway so the self-ping path early-outs (compiles + links, never
exercised — matches the fuzz threat model which targets frame
serialization, not the network stack).

Co-Authored-By: claude-flow <ruv@ruv.net>

v2/crates/wifi-densepose-hardware/src/esp32_parser.rs

@@ -16,7 +16,8 @@
 //! 12      4     Sequence number (LE u32)
 //! 16      1     RSSI (i8)
 //! 17      1     Noise floor (i8)
-//! 18      2     Reserved
+//! 18      1     PPDU type (ADR-110: 0=HT/legacy, 1=HE-SU, 2=HE-MU, 3=HE-TB)
+//! 19      1     Flags (ADR-110: bit0 bw40, bit2 STBC, bit3 LDPC, bit4 15.4-sync)
 //! 20      N*2   I/Q pairs (n_antennas * n_subcarriers * 2 bytes)
 //! ```
 //!
@@ -240,12 +241,31 @@ impl Esp32CsiParser {
             }
         }
 
-        // Determine bandwidth from subcarrier count
-        let bandwidth = match n_subcarriers {
-            0..=56 => Bandwidth::Bw20,
-            57..=114 => Bandwidth::Bw40,
-            115..=242 => Bandwidth::Bw80,
-            _ => Bandwidth::Bw160,
+        // Determine bandwidth from PPDU type + subcarrier count (ADR-110).
+        //
+        // HE-LTF uses a 4x denser tone grid than HT-LTF on the same channel
+        // width: HE20 = 256-FFT (242 active tones), HE40 = 512-FFT (484
+        // active). So a 256-bin frame on an HE PPDU is *20 MHz*, not 160.
+        // For HE frames the firmware also writes the bandwidth into byte 19
+        // bit 0 (see Adr018Flags::bw40) — prefer that when set.
+        //
+        // HT/legacy keeps the count heuristic, with 64 included in the 20 MHz
+        // bucket: ESP32 HT20 CSI delivers the full 64-bin FFT grid (live
+        // capture evidence: 148-byte frames = 64 subcarriers on a 20 MHz
+        // channel, issue #1005).
+        let bandwidth = if ppdu_type.is_he() {
+            if adr018_flags.bw40 || n_subcarriers > 256 {
+                Bandwidth::Bw40
+            } else {
+                Bandwidth::Bw20
+            }
+        } else {
+            match n_subcarriers {
+                0..=64 => Bandwidth::Bw20,
+                65..=128 => Bandwidth::Bw40,
+                129..=242 => Bandwidth::Bw80,
+                _ => Bandwidth::Bw160,
+            }
         };
 
         let frame = CsiFrame {