feat(firmware): validate configuration and migrate sensor-driven flight APIs

Validate configuration through its owning schemas and keep board
declarations separate from shared F722 resource ownership. Bound USB
transitions, isolate transport failures and retain restart-only activation.

Migrate navigation and flight consumers with the sensor and schema
contracts. Require explicit installation data and synchronous output
authority; board motor outputs remain inhibited.

Validation: assembled-prefix host tests, strict Clippy, platform/USB tests
and both ARM release builds. Final-source coverage and scoped Miri/Kani
evidence are retained separately from hardware qualification.

firmware/libs/kaptan-mavlink/build.rs

@@ -5,9 +5,7 @@ fn main() {
     let definitions = manifest_directory.join("definitions");
     let dialect = definitions.join("kaptan.xml");
     println!("cargo::rerun-if-changed={}", definitions.display());
-    // The upstream generator conditionally emits derives for these optional
-    // ecosystem crates. Kaptan deliberately does not expose those incomplete
-    // features, so tell rustc the generated inactive cfgs are intentional.
+    // The generator emits these feature gates, but this crate leaves them disabled.
     println!("cargo::rustc-check-cfg=cfg(feature, values(\"serde\", \"arbitrary\", \"ts-rs\"))");
     let output_directory = std::env::var("OUT_DIR").unwrap();
     mavlink_bindgen::generate(
@@ -15,9 +13,7 @@ fn main() {
         &output_directory,
     )
     .unwrap();
-    // Bindgen's index feature-gates every dialect module. Kaptan has exactly
-    // one unconditional dialect, so load its generated file as a normal Rust
-    // module instead of exposing a redundant Cargo feature.
+    // Bypass bindgen's feature-gated index to load the Kaptan dialect unconditionally.
     std::fs::write(
         PathBuf::from(output_directory).join("kaptan_module.rs"),
         "#[allow(non_camel_case_types, non_snake_case)]\n\