feat: add signed Device Support control v2 host

[frahlg]

Summary

• add FTW host API v2 for signed Device Support control packages while keeping all v1, bundled, and local drivers unchanged
• verify the installed package envelope and bind control to the active package ID, version, artifact SHA-256, target ABI, and an exact site opt-in
• restrict the first v2 profile to Modbus read/write, gate each permission, deny writes in init/poll/cleanup, and require a bounded command or default-mode scope
• add host-owned leases, expiry/stale/shutdown default recovery, structured command results, and a bounded local SQLite audit
• require successful writes and host-observed readback for FTW Modbus control

Safety state

This PR does not enable or publish a control driver. Device Support still has Sungrow control_enabled false. Keep it false until the v2 adapter passes physical HIL for normal control, expiry, network loss, restart/process kill, hot reload, and rollback.

One runtime gap remains before that HIL gate: GopherLua does not expose a safe per-VM heap limit. Its SetMx API watches the whole Go process and exits it, so this PR does not use it. The v2 VM has call deadlines, fixed stack bounds, a small library set, artifact/result/input/write limits, and no native module loading, but the control target must stay off until we choose a safe heap isolation plan.

Verification

• make verify
• all Go packages
• 35 optimizer tests in a uv-created Python environment
• Compose migration and container boundary tests
• go vet and go build
• focused v2 tests cover exact pins, signed policy reload, Modbus-only permissions, write-phase denial, pre-write and failed-write readback rejection, partial-command default recovery, lease expiry, canceled lifecycle calls, and old v1 compatibility