Integration: merge wingsail, rudder and pdb module branches into main

[georgesleen]

Single integration branch bringing all four module branches into main
together, so the conflicts between them are resolved once, deliberately,
rather than four times by whoever merges last.

Supersedes #59 (wingsail), #60 (rudder) and #61 (pdb). All four tips are
contained here:

Branch	Tip	Merge
rudder-working-branch	f062937	clean
pdb-working-branch	e31d2c2	clean
sense-integrated	e70c420	clean
wingsail-working-branch	334ee7f	19 conflicts, resolved below

sense-integrated is used rather than sense-working-branch. The two are
siblings forked from the same commit on main, not ancestor and descendant.
sense-working-branch is a five-day prototype from October 2025, dead since;
sense-integrated is the line that continued through to the new SENSE board.

It also adds CI and a flake, described at the end.

Merged in the order rudder -> pdb -> wingsail -> sense. Rudder, pdb and sense do not conflict
with each other or with the result at all; every conflict is wingsail against the others.

How conflicts were resolved

By ownership: each controller project goes to the branch that develops it, and
shared modules go to the version that is actually safe to share.

firmware/com-modules/CANFD/can.c -> rudder. This file does not exist on
main and was added independently on the branches, so it was an add/add
conflict. Rudder's copy wins for two concrete reasons:

• It is the only one that keeps __weak on HAL_FDCAN_RxFifo0Callback and
  HAL_TIM_PeriodElapsedCallback (rudder 2, wingsail 0, pdb 0). Without
  __weak, any controller project defining its own callback gets a duplicate
  symbol at link time, which defeats the purpose of a shared module.
• It is the only one that counts a heartbeat TX failure
  (can_heartbeat_tx_failures++) rather than calling Error_Handler(). On the
  bench with no CAN ACK, the other two fault the whole board every 10 seconds.

library-test-project can.h / can.c -> wingsail. Note for reviewers:
rudder's committed copies of these two files contain unresolved conflict
markers (2 in can.h, 12 in can.c). Wingsail's are clean, so ownership was
overridden here. Worth fixing on rudder-working-branch independently of this
PR.

firmware/PLRS-IMU -> rudder (e01ef3b). Wingsail carried a 160000
gitlink with no .gitmodules file at all, so the submodule was unusable
from a fresh clone and git reported "no merge base". Rudder ships a valid
.gitmodules and a newer commit, and wingsail does not reference PLRS-IMU.

Rest: wingsail-controller/* and drv-modules/nmea0183/* to wingsail;
rudder-controller/.cproject, BNO055-imu, motor-base-PID to rudder;
.gitignore is the union of both sides; the two stm32u5xx_hal_tim*.c rename
collisions were restored from clean vendored copies.

Verified afterwards: zero conflict markers anywhere in the tree, can.c has
rudder's 2 __weak markers and the non-fatal heartbeat, wingsail's main.c
retains its BRITER integration, and .gitmodules is present.

Known issues carried in, not introduced here

• can.c is duplicated: 3 copies on rudder and wingsail, 4 on pdb. pdb's
  commit e31d2c2 "Remove hard fault on heart beat CAN error" fixed a
  project-local copy, while its shared copy still calls Error_Handler().
  Consolidating these should be follow-up work.
• Wingsail's gated CAN TX/HB debug logging is dropped by taking rudder's
  can.c. Worth porting back on top, it is genuinely useful.
• Two compiled .exe binaries (~346 KB each) are tracked under
  rudder-control-model/, and nmea-sample.txt is 85,193 lines.

Per the README this needs two sign-offs, one from an ELEC lead.

CI and toolchain (added on this branch)

There was no CI in this repo before. Two jobs now run on every PR, both from
the flake so local and CI use the same environment:

• ioc-sync compares each .ioc's declared peripherals against the
  MX_<PERIPH>_Init functions in its generated main.c, and pins the CubeMX
  version. Running CubeMX itself in CI is not viable: it raises a modal
  migrate/continue/cancel dialog on any version mismatch, even in -q script
  mode, so a headless run just blocks.
• host-tests builds the drv-modules against stub HAL headers with plain gcc
  and runs all six suites.

canfd_test previously did not compile, so the CANFD module, the one piece of
code shared by every controller, had no coverage. The stub HAL now provides
__weak, the TIM types and the FDCAN bus-error notification bits, and all six
suites pass under -Werror.

flake.nix pins STM32CubeMX to 6.15.0 (nixpkgs ships 6.17.0) via
nix/stm32cubemx.nix. Four of seven projects are already on 6.15.0. The three
that are not are recorded in tools/ioc-version-exceptions.txt with reasons;
that file is scaffolding and should be deleted once every project is
regenerated on the pinned version.

Firmware verification status

Board	Verified against branch
wingsail	yes, read back and byte-matched after flashing the branch tip
pdb	yes, string fingerprint, 29 authored literals all present
rudder	no, not read back; assumed from the local build
sense	no, board carries a Heartbeat!! literal that exists nowhere in sense-integrated at any commit, so it is running an unpushed local build