fix: tighten version parsing, propagate HMAC sign failure, add deployment docs

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

server/test_ota_endpoint.py

@@ -74,3 +74,10 @@ def test_check_malformed_manifest(tmp_path):
     (tmp_path / "manifest.json").write_text("not valid json{{{")
     result = ota_check_impl(current_version="1.0.0", firmware_dir=tmp_path)
     assert result["update"] is False
+
+
+def test_check_wrong_arity_version_no_update(tmp_path):
+    write_firmware(tmp_path, "1.2")  # wrong arity server version
+    result = ota_check_impl(current_version="1.0.0", firmware_dir=tmp_path)
+    # server "1.2" → (0,0,0) ≤ client (1,0,0) → no update
+    assert result["update"] is False