feat(firmware): validate configuration and migrate sensor-driven flight APIs

Validate configuration through its owning schemas and keep board
declarations separate from shared F722 resource ownership. Bound USB
transitions, isolate transport failures and retain restart-only activation.

Migrate navigation and flight consumers with the sensor and schema
contracts. Require explicit installation data and synchronous output
authority; board motor outputs remain inhibited.

Validation: assembled-prefix host tests, strict Clippy, platform/USB tests
and both ARM release builds. Final-source coverage and scoped Miri/Kani
evidence are retained separately from hardware qualification.

firmware/libs/kaptan-sensor/src/imu.rs

@@ -7,14 +7,24 @@ use kaptan_time::Timestamp;
 /// Acceleration is milligravity, angular rate is milliradians per second, and
 /// temperature is centidegrees Celsius. The board-frame transform is complete
 /// before this value is published.
+///
+/// Current MPU6000 and ICM-42688-P decoders round integer conversions toward
+/// zero. Across their configured ranges, decoded acceleration is within
+/// ±16,000 mg and angular rate within ±34,871 mrad/s, including mounting sign
+/// changes. Temperature is within -22,234..=27,233 cdegC. These are backend
+/// representation bounds over every raw i16 value, not physical operating
+/// limits or validation performed by this public snapshot type.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct ImuSnapshot {
-    /// Monotonic timestamp captured at acquisition interrupt entry.
+    /// Host monotonic acquisition-request time, captured immediately before the
+    /// accepted register read is submitted by the worker. This is neither DRDY
+    /// ISR entry nor the sensor's physical sampling epoch. Register updates,
+    /// filtering and deferred/coalesced interrupts prevent that inference.
     pub timestamp: Timestamp,
     /// Body-frame acceleration in milligravity.
     pub acceleration_milligravity: [i16; 3],
     /// Body-frame angular rate in milliradians per second.
-    pub angular_rate_milliradians_per_second: [i16; 3],
+    pub angular_rate_milliradians_per_second: [i32; 3],
     /// Sensor temperature in centidegrees Celsius.
     pub temperature_centidegrees_celsius: i16,
 }
@@ -24,7 +34,7 @@ impl ImuSnapshot {
     pub const fn new(
         timestamp: Timestamp,
         acceleration_milligravity: [i16; 3],
-        angular_rate_milliradians_per_second: [i16; 3],
+        angular_rate_milliradians_per_second: [i32; 3],
         temperature_centidegrees_celsius: i16,
     ) -> Self {
         Self {

firmware/libs/kaptan-sensor/src/lib.rs

@@ -1,8 +1,4 @@
 //! Hardware-independent sensor observations and units.
-//!
-//! Sensor data is immutable after publication. Bus transactions, queueing,
-//! protocol encoding, PAC access, RTIC mechanics, and board transforms do not
-//! belong in this crate.
 
 #![no_std]
 

firmware/libs/kaptan-sensor/src/optical_flow.rs

@@ -3,10 +3,6 @@
 use kaptan_time::Timestamp;
 
 /// Coherent ground-referenced optical-flow observation in the sensor frame.
-///
-/// Linear velocity and ground distance use integer SI subunits so acquisition
-/// remains independent of the floating-point representation required by some
-/// outbound wire protocols.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct OpticalFlowSnapshot {
     /// Flight-controller monotonic time at observation reception.

firmware/libs/kaptan-sensor/src/range.rs

@@ -4,12 +4,11 @@ use kaptan_time::Timestamp;
 
 /// Coherent range observation in the sensor frame.
 ///
-/// The timestamp is captured when the measurement is requested. Distance is
-/// expressed in millimetres so rangefinders with centimetre resolution can be
-/// published without floating-point conversion.
+/// Distance is in millimetres. LIDAR-Lite timestamps the request and MTF-01
+/// timestamps frame reception. Neither establishes the physical sample epoch.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct RangeSnapshot {
-    /// Monotonic timestamp captured when the acquisition was requested.
+    /// Producer timestamp in the controller monotonic clock domain.
     pub timestamp: Timestamp,
     /// Measured distance in millimetres.
     pub distance_millimetres: u32,