Add split lighting observability and attestation

[colonelpanic8]

Summary

• add deterministic coverage for the existing split-lighting codec, staging, queue, digest, and recovery invariants
• attest central/peripheral lighting replication with fixed-width digests, bounded recovery, reconnect probing, and a halted terminal state
• expose presented-frame readback and seven-state replica diagnostics through glove80-control
• preserve the physical-presence gate with the current Rynk per-session unlock protocol
• pin RMK assembled at 7489f6bc and the reproducing assembly maintenance commit at cebab43

Design constraints

• legacy acknowledgements remain unchanged for mixed-firmware compatibility
• diagnostic replies enter the depth-two peripheral queue only when it is empty, preserving acknowledgement priority
• frame transfer is stateless and stop-and-wait; mixed revisions are rejected
• expiring overlay lifetime is excluded from the durable digest
• the current protocol intentionally supports one peripheral

Verification

• glove80-control: 11 unit tests, 3 Glove80 geometry tests, 2 Go60 geometry tests
• split-lighting-tests: 9 tests
• rustfmt checks for the control, Glove80, and Go60 crates
• Glove80 left and right release firmware builds
• Go60 left and right release firmware builds
• final runs used the exact RMK and assembly submodule pins in this PR

Depends on:

• Expose split lighting frame and replica observability rmk#9
• Assemble lighting observability on the current RMK stack rmk-assembly#1

[colonelpanic8]

Hardware canary update (jay-lenovo):

• Rebuilt and published RMK assembly 0ac6cae0 from upstream 65df1577; Glove80 pin is b7e409b3.
• just check, both Glove80 halves, and both Go60 halves pass.
• Exact generated RMK assembly passes 665/665 nextest cases plus protocol/type and no-default-feature checks.
• Flashed the left/central Glove80 half. Version/capabilities, five repeated brightness + replica-status cycles, and full lighting read all succeeded without the former USB reset. Frame read correctly returns Locked while physical unlock is absent.
• The right/peripheral half remains physically offline from the earlier failed canary and needs a power cycle before two-half reconnect/attestation qualification can finish.