feat(firmware): validate configuration and migrate sensor-driven flight APIs

Validate configuration through its owning schemas and keep board
declarations separate from shared F722 resource ownership. Bound USB
transitions, isolate transport failures and retain restart-only activation.

Migrate navigation and flight consumers with the sensor and schema
contracts. Require explicit installation data and synchronous output
authority; board motor outputs remain inhibited.

Validation: assembled-prefix host tests, strict Clippy, platform/USB tests
and both ARM release builds. Final-source coverage and scoped Miri/Kani
evidence are retained separately from hardware qualification.

docs/src/errors.md

@@ -78,14 +78,25 @@ different reportable error is already pending.
   `PersistConfigurationError` ID that distinguishes journal geometry, model,
   sequence, flash-controller, bounds, unlock, and verification
   failures. Replaying the cached close result does not repeat the report or
-  flash operation.
+  flash operation. Any persistence error makes committed state unknown and
+  blocks ordinary saves until reboot recovery or a successful explicit factory
+  reset. Boot-active values remain unchanged.
+- A stale KCFG expected base returns `REQUEST_CONFLICT` before persistence.
+  It is a reload-required editing conflict, not a reportable firmware error.
+  Invalid boot configuration uses the UART-disabled USB setup path and retains
+  readable saved values for repair. See [Configuration](configuration.md).
+- SPI completion errors never copy partial data into the caller's receive
+  buffer. If bounded shutdown cannot establish quiescence, the SPI route
+  quarantines its static DMA storage and refuses further transfers. This is
+  distinct from transient `Busy`. Physical SPI shutdown and fault behavior
+  remain hardware-validation work.
 - Reported `ReportableError` values reach the F722 MAVLink worker as a
   `ERROR`, subject to bounded transport admission. The payload is
   `{ error_id, raised_at[96] }`. `raised_at` is a zero-padded UTF-8
   `file:line` prefix for the reporting point.
   Dynamic human-readable context belongs in `LOG`, while
   structured protocol failures remain in their owning response message.
-- Control, navigation, and safety error types are derive-ready but
+- Control, navigation and safety error types are derive-ready but
   their live owners are not yet attached to a MAVLink worker.
 
 F722 uses `panic-halt`, without live panic reporting or retained-record replay.