fix(actuator): validate reference timing calculations

Reject invalid DShot and PWM timer domains and widen arming-duration
calculations before composing their results.

Validation: actuator tests, strict Clippy and five Kani component proofs.

firmware/Cargo.toml

@@ -38,6 +38,7 @@ rust-version = "1.90"
 
 [workspace.lints.rust]
 unsafe_op_in_unsafe_fn = "deny"
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(kani)'] }
 
 [workspace.lints.clippy]
 undocumented_unsafe_blocks = "deny"