fabric: harden MCU update transfer path

[cpunt]

Summary

• Enforces signed MCU update images using the pico2-a-b/imagev1 verifier and trusted target/key policy.
• Streams only verified payload bytes into the inactive A/B slot on TinyGo.
• Keeps transfer recovery to documented fields only: required per-chunk chunk_digest, malformed/digest retry, idle xfer_need retry, and 1024-byte raw chunks for the current link.

Why

This is the security hardening layer on top of the Fabric update path. It removes the unsigned passthrough verifier and avoids adding non-Lua protocol fields.

Testing

• go test ./...
• Hardware e2e attempted from this container; TinyGo build succeeded, pack stopped because picotool is not installed on PATH.