Firmware promotion — pipeline built, activation pending

The firmware promotion lane is implemented in this console, but firmware promotion is intentionally not yet enabled. Two conditions must be met first:

• Physical bench sign-off of the exact signed .bin on real hardware.
• The environment-agnostic firmware change (read the cloud host from NVS at boot so one signed binary is promotable dev → prod byte-identical).

Until then, firmware is managed from the dashboard on each server. Direct firmware upload is disabled on production; rollback (set a previously promoted build active) remains available there.