Audit: 10 bug fixes, 5 deletions, CI action pinning

[AndrewDemsDS]

Summary

Full four-concern audit of the repo (bugs / simplification / performance / CI-CD), executed one item per commit. Correctness first, then deletions, then CI. All host gates green after every step (host codec/map tests, .zap contiguity, esp32-lint, shellcheck, ruff).

Bug fixes (10)

• hisense_rs485.h + matter_drivers.cpp + app_main.cpp: shadow setpoint sync wedged in Fahrenheit. The downlink re-sync range-checked the always-Celsius st.setpoint_c against the shadow's previous unit. Once the shadow held F, no Celsius value ever passed the 61-90 F window, so the shadow froze at its first F value and every later command silently re-imposed the stale setpoint (plus a 1 Hz error log). New pure helper hisense_shadow_setpoint_from_status() validates in the wire unit; the ESP32 side moves to the same helper and no longer flips the unit while keeping a stale value on an out-of-range report. Golden host tests pin the F-mode sequence and out-of-range refusal. Ships ameba v1.3.6 + esp32 v1.1.2.
• ESP32: break-glass listener now starts in BOTH flavours. breakglass_start() sat inside CONFIG_HISENSE_DEBUG_BUILD, so release images never opened :2324 and never logged the fail-closed warning: the exact gap the feature's own contract rules out.
• ESP32: fault endpoint is created LAST. esp-matter assigns endpoint IDs in creation order, and fault was created before coil/display: the node actually ran fault=8, coil=9, display=10 while every comment, the docs, and hil_display_actuation.py (DISPLAY_EP=9) assumed 8=coil / 9=display / 10=fault. Action needed after the next ESP32 OTA: re-interview node 28 and drop the three orphaned HA entities (coil/display/fault remap to the corrected IDs).
• ota-release.sh: build forwards all flags. build "${1:-}" dropped everything after the first, so build --bump --debug silently built the release flavour: the same silent-flavour-drop class the script hard-dies on elsewhere.
• Driver fault map: comments now teach the confirmed base-15 (wire bytes 39/40/64/66), not the falsified base-13 the struct comments and two derivation blurbs still described.
• Driver: fault length gates were one byte too strict (len > B+1 to read buf[B]); a frame of exactly B+1 silently lost that group's coverage. Boundary tests added.
• AmebaZ2: no stale pre-loss status on link restore. The link-lost branch left s_status_fresh set, so the restore event could republish pre-loss values for a beat.
• Docs-site assembler: meta description built from the real line position. lines.index(raw) used the first occurrence of a duplicated line (fenced code blocks were the realistic trigger); also drops the O(n^2) scan. Assembled site verified byte-identical on the current docs.
• ESP32 brownout comment now matches the deliberate level-0 setting (the block argued for level 4 against its own values; app_main.cpp documents the evidence-gathering decision).
• ota-release.sh: deterministic-clock shim built fresh per run into a private mktemp dir instead of reusing the predictable /tmp/ota-det-time-<uid>.so, which would LD_PRELOAD whatever sat at that known path into the packaging make.

Simplifications (5)

• Delete sdk-edits/core-patches/ (byte-for-byte duplicate of a diff already in patches/connectedhomeip.patch, which setup.sh applies).
• Delete never-called hisense_build_status_request() + hisense_deinit() (zero callers in repo, both ESP32 targets, and the SDK tree).
• Delete orphaned esp32-matter/smoketest/main/smoketest.cpp (not in CMake; duplicate app_main).
• Delete superseded ota_go.py (also internally stale: printed "v2", sent version 12).
• Drop the HTTPS_OTA_URL alias; comment header now counts endpoints 1..10.

Deliberately left alone: the EPM delegate's interface surface (harmonic reads + never-called setters are Delegate overrides / upstream-derived shim; removable mass is small and verification needs a full SDK build), the recon/diag console duplication (two build systems, consoles evolve separately), bench one-shots (mcli/mnodes/drive_ac/matter_scan, flasher utilities), test-only helpers (covered by tests).

Performance

Baselines: host suite 0.75 s, lint 0.78 s, QA job ~15 s, docs site ~60 s, AmebaZ2 tag build ~3.5 min, ESP32 tag build ~10.5 min. No code changes recommended: the QA gate is already fast and correctly ordered, and the full-clean firmware builds are slow by design. One hypothesis for the operator to trial on the runner (not a repo change): IDF_CCACHE_ENABLE=1 for the ESP32 tag builds.

CI/CD (1)

• SHA-pin every action in pages.yaml (was all floating major tags) and checkout in the Gitea build, to the newest release of the major each already used. Matches the repo's stated policy and the other three workflows; Dependabot keeps the pins current. Verify on the next pages run: same ~60 s job, pinned refs in the log.

Test plan

• firmware/test/run_tests.sh (375 codec/map checks incl. new shadow-sync + fault-boundary tests)
• ota-release.sh lint (host tests + .zap contiguity + version monotonicity)
• esp32-lint.sh (PROJECT_VER 1.1.2 <-> sdkconfig 10102)
• shellcheck / ruff
• Docs-site output byte-identical to main after the assembler fix
• Gitea sdk-builder full AmebaZ2 build (runs on push of this branch's mirror)
• Post-merge: next AmebaZ2 + ESP32 OTA cycles exercise the shipped fixes; re-interview node 28 for the endpoint remap