feat(firmware): ESP32-C6 target — Wi-Fi 6 / 802.15.4 / TWT / LP-core (ADR-110)

`firmware/esp32-csi-node` now builds for both `esp32s3` (existing
production) and `esp32c6` (new research / battery-seed target) from
the same source tree. ESP-IDF auto-applies `sdkconfig.defaults.esp32c6`
when the target is set to esp32c6; every C6 module is gated on
CONFIG_IDF_TARGET_ESP32C6 (or the SOC_WIFI_HE_SUPPORT capability) so
the S3 build path is byte-identical to today.

New modules (all #ifdef-gated, no-op stubs on S3):
- c6_twt.{h,c}      — iTWT wrapper, graceful AP-NACK fallback
- c6_timesync.{h,c} — 802.15.4 beacon-based mesh time-sync, EUI-64
                      leader election, c6_timesync_get_epoch_us()
- c6_lp_core.{h,c}  — wake-on-motion deep-sleep helper (ext1 path
                      this cut; real LP-core polling deferred)

ADR-018 frame extension:
- byte 18: PPDU type (0=HT/legacy, 1=HE-SU, 2=HE-MU, 3=HE-TB)
- byte 19: bandwidth + STBC + 802.15.4-sync-valid flags
- Magic 0xC5110001 unchanged — backwards compatible
- Dual-branch encoding handles both struct variants of
  wifi_pkt_rx_ctrl_t (legacy S3 / HE C6) per CONFIG_SOC_WIFI_HE_SUPPORT

Critical bug fixed during live witness collection (verified across 3
boards on COM6/COM9/COM12):
- c6_timesync.c read MAC into a 6-byte buffer and ran MAC-48->EUI-64
  conversion. But esp_read_mac(ESP_MAC_IEEE802154) returns 8 bytes
  already in EUI-64 form on C6 — code was double-inserting FFFE.
  Boot log was 206ef1fffefffe17, fix yields 206ef1fffe17278c which
  matches esptool's eFuse reading exactly.

Tooling:
- CI workflow (firmware-ci.yml) extended with c6-4mb matrix row +
  ADR-110 host-unit-test step
- Host unit tests for pure functions (mac48_to_eui64,
  eui64_bytes_to_u64, PPDU encoding both branches) — runs on Ubuntu CI
- Multi-board live-capture harness (test/capture-3board-experiment.py)
- Witness bundle script records SHA-256s for s3-adr110, c6-adr110, and
  s3-fair-adr110 (apples-to-apples) binary archives

Honest empirical findings (full report in docs/WITNESS-LOG-110.md):
- Verified live on 3 C6 boards: boot, 802.15.4 init w/ correct EUIs,
  WiFi STA reaching assoc->run on ruv.net, TWT setup attempted +
  gracefully NACKed (AP is 11n-only, TWT Responder:0), HE-MAC firmware
  loaded
- NOT verified (need 11ax AP / second-channel exp / INA meter):
  HE-LTF subcarrier expansion, TWT cadence determinism, ±100 µs sync
  alignment, 5 µA hibernation
- Bug found: leader election doesn't step down under live WiFi load —
  likely 2.4 GHz radio coex preemption (WiFi ch 5 vs 15.4 ch 15);
  follow-up task #30
- Apples-to-apples size: S3-no-display = 886 KB, C6 = 1003 KB
  (C6 is 13% LARGER for equivalent CSI features; the extra is the
  802.15.4 + OpenThread stack that S3 lacks)

Tracking: ruvnet/RuView#762

Co-Authored-By: claude-flow <ruv@ruv.net>

firmware/esp32-csi-node/main/main.c

@@ -33,6 +33,9 @@
 #include "swarm_bridge.h"
 #include "rv_radio_ops.h"          /* ADR-081 Layer 1 — Radio Abstraction Layer. */
 #include "adaptive_controller.h"   /* ADR-081 Layer 2 — Adaptive controller. */
+#include "c6_twt.h"                /* ADR-110: TWT (no-op stub on S3) */
+#include "c6_timesync.h"           /* ADR-110: 802.15.4 mesh time-sync (no-op on S3) */
+#include "c6_lp_core.h"            /* ADR-110: LP-core hibernation (no-op on S3) */
 #ifdef CONFIG_CSI_MOCK_ENABLED
 #include "mock_csi.h"
 #endif
@@ -147,13 +150,27 @@ void app_main(void)
     csi_collector_set_node_id(g_nvs_config.node_id);
 
     const esp_app_desc_t *app_desc = esp_app_get_description();
-    ESP_LOGI(TAG, "ESP32-S3 CSI Node (ADR-018) — v%s — Node ID: %d",
-             app_desc->version, g_nvs_config.node_id);
+#if defined(CONFIG_IDF_TARGET_ESP32C6)
+    const char *target_name = "ESP32-C6";
+#elif defined(CONFIG_IDF_TARGET_ESP32S3)
+    const char *target_name = "ESP32-S3";
+#else
+    const char *target_name = "ESP32";
+#endif
+    ESP_LOGI(TAG, "%s CSI Node (ADR-018 / ADR-110) — v%s — Node ID: %d",
+             target_name, app_desc->version, g_nvs_config.node_id);
 
-    /* Turn off onboard WS2812 LED on GPIO 38 */
+    /* Turn off onboard WS2812 LED.
+     * S3 dev boards put the LED on GPIO 38; C6 dev boards on GPIO 8.
+     * On C6, GPIO 38 doesn't exist (only 0-30) — gate the init by target. */
+#if defined(CONFIG_IDF_TARGET_ESP32C6)
+    const int led_gpio = 8;
+#else
+    const int led_gpio = 38;
+#endif
     led_strip_handle_t led_strip;
     led_strip_config_t strip_config = {
-        .strip_gpio_num = 38,
+        .strip_gpio_num = led_gpio,
         .max_leds = 1,
         .led_model = LED_MODEL_WS2812,
         .color_component_format = LED_STRIP_COLOR_COMPONENT_FMT_GRB,
@@ -167,6 +184,27 @@ void app_main(void)
         led_strip_clear(led_strip);
     }
 
+    /* ADR-110 P4: 802.15.4 mesh time-sync (C6 only).
+     * Initialized BEFORE WiFi so it's available even when WiFi STA can't
+     * connect — the radios are physically independent on the C6.
+     * No-op on S3 (the helper compiles to an empty inline stub). */
+#if defined(CONFIG_IDF_TARGET_ESP32C6) && defined(CONFIG_C6_TIMESYNC_ENABLE)
+    esp_err_t ts_ret = c6_timesync_init(CONFIG_C6_TIMESYNC_CHANNEL);
+    if (ts_ret != ESP_OK) {
+        ESP_LOGW(TAG, "c6_timesync_init failed: %s (continuing without 15.4 sync)",
+                 esp_err_to_name(ts_ret));
+    }
+#endif
+
+    /* ADR-110 P5: Optionally arm LP-core wake-on-motion (C6 only, opt-in).
+     * Default off — only nodes flashed for battery-powered seed duty enable
+     * this in menuconfig. */
+#if defined(CONFIG_IDF_TARGET_ESP32C6) && defined(CONFIG_C6_LP_CORE_ENABLE)
+    if (c6_lp_core_was_motion_wake()) {
+        ESP_LOGI(TAG, "boot cause: LP-core motion wake (running CSI burst)");
+    }
+#endif
+
     /* Initialize WiFi STA (skip entirely under QEMU mock — no RF hardware) */
 #ifndef CONFIG_CSI_MOCK_SKIP_WIFI_CONNECT
     wifi_init_sta();
@@ -208,6 +246,14 @@ void app_main(void)
     }
 #endif
 
+    /* ADR-110 P3: Request TWT from the AP for deterministic CSI cadence.
+     * No-op on S3 (the helper compiles to an empty inline stub). On C6
+     * the AP may NACK — the helper logs and falls back to opportunistic.
+     * Called only after WiFi STA connect (wifi_init_sta blocks until then). */
+#if defined(CONFIG_IDF_TARGET_ESP32C6) && defined(CONFIG_C6_TWT_ENABLE)
+    c6_twt_setup_default();
+#endif
+
     /* ADR-039: Initialize edge processing pipeline. */
     edge_config_t edge_cfg = {
         .tier              = g_nvs_config.edge_tier,