fix(esp32-release): load the env in build(); bump esp32 to 1.1.1

build() never called load_env -- only package/stage/flash did -- so the recovery-credential guard
could not see BREAKGLASS_TOKEN from ota-release.env and rejected an otherwise correct build. The
guard was reading an environment the rest of the script only populates later. Caught immediately
by the guard itself on its first real use.

With the env loaded, a build through this script now reports both credentials baked in:

  hisense: manual OTA URL set from build config
  hisense: break-glass trigger ENABLED (token set from build config)

Also verified the guard fires correctly: building without HISENSE_OTA_URL dies with the USB-only
explanation rather than silently shipping a placeholder.

PROJECT_VER 1.1.0 -> 1.1.1 (int 10101) with sdkconfig kept in sync, so the pending node-35 flash
is verifiable by a changed softwareVersion rather than by a reboot -- the mistake that made the
ameba break-glass look like it worked for most of a day.

NOT FLASHED: node 35 is not responding to esptool ("Unable to verify flash chip connection",
plus a nonsense 15.55 MHz crystal reading on a 40 MHz part), so this is a cable/power/seating
issue at the module rather than anything in the image. The build is archived and ready.

Assisted-by: AI

Author: AndrewDemsDS

firmware/esp32-matter/CMakeLists.txt

@@ -2,7 +2,7 @@
 #   . ~/esp/esp-idf-v5.5.4/export.sh && . $ESP_MATTER_PATH/export.sh
 #   idf.py set-target esp32 && idf.py build flash monitor
 cmake_minimum_required(VERSION 3.16)
-set(PROJECT_VER "1.1.0")
+set(PROJECT_VER "1.1.1")
 
 # Unified versioning (issue #77): the Matter softwareVersion INT is DERIVED from PROJECT_VER --
 # MAJOR*10000+MINOR*100+PATCH -> a readable, strictly-monotonic uint32. This keeps the human

firmware/esp32-matter/sdkconfig.defaults

@@ -46,8 +46,8 @@ CONFIG_CUSTOM_DEVICE_INFO_PROVIDER=y
 # so it (and the fallback NUMBER) MUST stay equal to PROJECT_VER or the device reports a stale
 # softwareVersionString. Edit PROJECT_VER in CMakeLists.txt, then update both lines below.
 # esp32-lint.sh enforces this equality (fails the commit/CI if they drift).
-CONFIG_DEVICE_SOFTWARE_VERSION_NUMBER=10100
-CONFIG_DEVICE_SOFTWARE_VERSION_STRING="1.1.0"
+CONFIG_DEVICE_SOFTWARE_VERSION_NUMBER=10101
+CONFIG_DEVICE_SOFTWARE_VERSION_STRING="1.1.1"
 # --- OTA hardening (faster + reliable on marginal Wi-Fi) ---
 # Delta OTA: ship a diff (tens of KB) instead of the full ~1.5MB image over BDX.
 CONFIG_ENABLE_DELTA_OTA=y

firmware/scripts/esp32-release.sh

@@ -101,6 +101,10 @@ load_env() {
 
 # ---- build (issue #82: archive-before-overwrite, then archive the fresh image) --------------
 build() {
+  # Load ota-release.env here too. build() used not to, so the recovery-credential guard below
+  # could not see BREAKGLASS_TOKEN from the env file and rejected an otherwise correct build --
+  # the guard was reading an environment the rest of the script populates later.
+  load_env
   command -v idf.py >/dev/null || die "idf.py not on PATH -- source the IDF + esp-matter env first"
   if [ "${ESP32_ALLOW_IDF_MISMATCH:-0}" = "1" ]; then
     say "WARNING: ESP32_ALLOW_IDF_MISMATCH=1 -- toolchain check skipped (lock v$(lock_idf_version) vs live v$(live_idf_version))"