feat(firmware): validate configuration and migrate sensor-driven flight APIs

Validate configuration through its owning schemas and keep board
declarations separate from shared F722 resource ownership. Bound USB
transitions, isolate transport failures and retain restart-only activation.

Migrate navigation and flight consumers with the sensor and schema
contracts. Require explicit installation data and synchronous output
authority; board motor outputs remain inhibited.

Validation: assembled-prefix host tests, strict Clippy, platform/USB tests
and both ARM release builds. Final-source coverage and scoped Miri/Kani
evidence are retained separately from hardware qualification.

firmware/libs/kaptan-i2c/Cargo.toml

@@ -7,3 +7,6 @@ version.workspace = true
 
 [lints]
 workspace = true
+
+[dependencies]
+kaptan-time = { path = "../kaptan-time" }

firmware/libs/kaptan-i2c/src/lib.rs

@@ -6,6 +6,8 @@
 
 #![no_std]
 
+use kaptan_time::Timestamp;
+
 /// Terminal outcome reported by an I²C controller.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum I2cCompletion {
@@ -17,6 +19,18 @@ pub enum I2cCompletion {
     TransferFault,
 }
 
+/// Completion admission or cancellation failure. Errors never copy read bytes.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum CompletionError {
+    NotPending,
+    NotActive,
+    InvalidLength,
+    TransferFault,
+    /// Physical STOP was not observed by the shutdown deadline. The controller
+    /// is halted and cannot accept another transaction during this boot.
+    StopUnproven,
+}
+
 /// Owns a non-blocking I²C controller route and its in-flight storage.
 ///
 /// Each operation sends a STOP on successful completion. Controllers copy a
@@ -38,13 +52,25 @@ pub trait I2cBus {
     /// Releases controller ownership after a hardware ISR acknowledged the
     /// terminal event and, for a successful read, copies into `read`.
     ///
-    /// This must not poll or wait. `read` must match the length submitted to
-    /// [`Self::start_read`] for the completed read transaction.
-    fn complete_transaction(&mut self, completion: I2cCompletion, read: Option<&mut [u8]>);
+    /// This must not poll or wait. `NotPending` is entirely nonmutating. A
+    /// successful read requires a matching destination length and controller
+    /// proof of the current transaction's STOP, not just a caller notification.
+    /// Old IRQs/completions must not retire or copy out a newer transaction.
+    fn complete_transaction(
+        &mut self,
+        completion: I2cCompletion,
+        read: Option<&mut [u8]>,
+    ) -> Result<(), CompletionError>;
 
     /// Cancels an in-flight transaction after a platform-selected timeout.
     ///
-    /// Implementations must release controller-owned transaction state and
-    /// arrange for any required STOP or peripheral recovery without waiting.
-    fn cancel_transaction(&mut self);
+    /// Requests STOP without waiting. Admission remains closed until STOP is
+    /// proven. This is not permission to reuse or free in-flight storage.
+    fn cancel_transaction(&mut self, now: Timestamp);
+
+    /// Services cancellation deadlines even without interrupts. The caller must
+    /// invoke this periodically with its monotonic boot clock. A bounded STOP
+    /// failure halts admission and returns `StopUnproven`. Storage must outlive
+    /// all hardware access, including owner drop/forget and failed cancellation.
+    fn service(&mut self, now: Timestamp) -> Result<(), CompletionError>;
 }