Confirm fault-decode extractor via disassembly (#38); drop dead mfg-cluster writes (#39)

[AndrewDemsDS]

Summary

Closes the two static-RE open questions behind the fault decode and removes dead telemetry-write code.

#38 — fault decode now CONFIRMED by disassembly

Two independent, adversarially cross-checked disassembly passes over the stock dump close docs/10 §7.5 opens #1 and #4:

• The stock fault extractor (0x9b6f8ac8) reads the same 66/00 periodic status frame the driver parses (call site gates byte0==0x66 && byte1==0, and the same buffer is passed in unmodified), and numbers wire bytes as 15 + group, matching the §5a getter 0x9b6f0ee6.
• The firmware's own compiled-in fault-name strings map 1:1 onto bytes 39/40/64/66.

The fault byte/bit map is therefore confirmed. What remains is the hardware fault-injection semantic gate (does a real fault actually fire the bit): a healthy unit reads all-clear and proves nothing. Added a turnkey runbook at docs/10 §7.6. The issue stays open as a HIL follow-up.

#39 — drop dead manufacturer-cluster writes

CompressorHz (0x0010) and OutdoorTemp (0x0011) are declared in the cluster XML but not enabled in the compiled .zap, so the writes in matter_drivers.cpp were UNSUPPORTED_ATTRIBUTE no-ops. Removed them (brings AmebaZ2 into parity with the ESP32 mfg read-back). Outdoor temp already reaches HA via the standard ep2 TemperatureMeasurement; raw compressor Hz exposure is deferred (reaches HA coarsely via ThermostatRunningState, fully via the :2323 console).

Also

• :2323 fault-console strings (both firmware flavours) and hisense_rs485.h confidence language: PROVISIONAL to confirmed-by-disasm.
• Version bump 1.3.16 to 1.3.18 (int 10318 > last on-device 10317).

Test

• Host QA firmware/test/run_tests.sh: all layers pass (codec, Matter/AC map, virtual round-trip).
• ota-release.sh lint + full ota-release.sh build --debug: green (serial 11418 verified, FIXED_ENDPOINT_ARRAY {0x0000..0x000A} contiguous).

Assisted-by: AI