feat(firmware): validate configuration and migrate sensor-driven flight APIs

Validate configuration through its owning schemas and keep board
declarations separate from shared F722 resource ownership. Bound USB
transitions, isolate transport failures and retain restart-only activation.

Migrate navigation and flight consumers with the sensor and schema
contracts. Require explicit installation data and synchronous output
authority; board motor outputs remain inhibited.

Validation: assembled-prefix host tests, strict Clippy, platform/USB tests
and both ARM release builds. Final-source coverage and scoped Miri/Kani
evidence are retained separately from hardware qualification.

docs/src/logs.md

@@ -60,11 +60,12 @@ Rust error variant. Renaming or reordering a variant does not change it.
 diagnostics. Protocol failures remain in their owning response; for example, a
 rejected KCFG upload returns a `FILE_CONTROL` failure and readable
 bounded detail.
-Delivery is bounded and lossy under link pressure; heartbeat and safety
+Delivery is bounded and lossy under link pressure. Heartbeat and sensor
 telemetry use separate paths. Logs have no publication rate setting and are
-not periodic streams. A retained event leaves its MAVLink sink only once the
-lower transport admits it; temporary queue pressure only defers that same
-event.
+not periodic streams. The worker offers each retained event to USB and every
+MAVLink UART, then removes it once at least one transport admits it. Admission
+does not prove receipt or delivery to every link. If none admits it, the event
+remains pending. Opening USB does not take diagnostics away from UART.
 
 ## Filtering
 
@@ -73,8 +74,11 @@ Trace (1), Debug (2), Info (3), Warn (4), and Error (5). `Info`, for example,
 accepts Info, Warn, and Error log events. `Off` suppresses `LOG` on MAVLink
 without suppressing reportable `ERROR` events or logs sent to another
 sink. There is no separate enable flag and no MAVLink-specific set of extra
-runtime log levels. F722 uses the validated filter recovered at boot, falling
-back to its board factory when the journal is empty or invalid.
+runtime log levels. F722 uses the validated boot-active filter. Empty storage
+uses factory values. Invalid storage selects the setup fallback, which also
+uses the factory filter but disables UART roles. Saved changes and factory
+reset do not alter the active filter until reboot. See
+[configuration recovery](configuration.md#recovery-and-activation).
 
 Events retain the compact typed `Level` and sink configuration retains the
 compact typed `LevelFilter`. Schema metadata supplies the filter choices to the
@@ -82,6 +86,4 @@ configurator.
 Only the MAVLink adapter converts the five event levels to the typed Kaptan
 wire enum.
 
-The log ingress is transport-neutral and unfiltered. F722 images accept the
-unsigned Kaptan file service on local USB CDC-ACM and their directly wired UART; that physical-link assumption does not extend to a shared
-or remote MAVLink network.
+The log ingress is transport-neutral and unfiltered.