Replaces placeholder ota_verify_signature_with_key with real mbedtls
ECDSA verify; adds 4-case native test suite with generated P-256 vectors.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Generates firmware signing keypair; private key stays in gitignored
secrets/, public key written as 65-byte C array to
firmware/lib/ota_updater/ota_pubkey.h for compile-time OTA verification.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>