Feature model: manifest, generator, gates, and the P2 ratchet

[angeloINTJ]

What

docs/analysis/MODELO_DE_RECURSOS.md lays out a model for making SIMUT's
features switchable: a single manifest describes what each firmware profile
turns on, a generator derives the PlatformIO config from it, and gates keep the
two from drifting. This PR is the P1 foundation of that model, the first
P0 cleanups it enables, and the P2 ratchet that will discipline the
seam extractions to come.

• tools/features.toml — the manifest: the six firmware profiles, their
  display choice, toggles, source-file cuts and lib_ignore, with the measured
  rationale for each (the byte counts that lived in platformio.ini's env
  blocks moved here).
• tools/gen_features.py — derives tools/generated/profiles.ini (the
  PlatformIO config) and features_model.json (for the future configurator).
• tools/check_features.py — proves, via PlatformIO's own resolver, that
  the environments the build uses resolve — flag for flag and translation-unit
  for translation-unit — to what the manifest describes.

platformio.ini now includes the generated profiles via extra_configs and no
longer defines [env:pico_w_*]; it keeps pico_base and the native_* test
environments.

Why it is safe

The switch is proven byte-identical: each of the six firmware.bin built
from the switched platformio.ini has the same sha256 as the image built before
the switch (clean builds, both sides). The generated source-filter order was
written to match the hand-written one, so link order does not move the image.

Verified locally, everything CI runs:

• the eleven gates-job checks (secrets, log codes, authorization, licence,
  Ângulo, fsguard, Air consistency, the two feature gates, the entanglement
  watermark, history merge);
• the seven native suites (185 / 63 / 33 / 45 / 39 / 16 / 29 cases);
• the six firmware images build byte-identical.

Both feature gates run in the CI gates job, so the manifest and the build
cannot drift apart. Each gate has a negative control (a mutation is caught).

P0 cleanups included

• Dropped the dead SIMUT_FACTORY_RESET flag (read nowhere in src/); the six
  images rebuild byte-identical, which confirms it was dead.
• Corrected three comments that disagreed with the project's own measured
  numbers: the Bluetooth cost (classic SPP, 64,732 B + 16,416 B, not "BLE UART,
  ~22 KB"), the mDNS cost (~15 KB, not "negligible"), and the OTA snapshot
  margin (1,430 B on v25, not the v21 "~3.4 KiB").
• Added pico_w_air to SHIPPING_ENVS so a page diet cannot leak into the one
  published image that was missing from it (unchanged, it declares no diet).
• Retargeted the Air C6 consistency gate — which read the air env from
  platformio.ini — to the manifest where the flag now lives.

P2 ratchet included

• tools/check_feature_sprawl.py counts the #if SIMUT_ sites per feature
  macro and per file in src/ and holds them to a high-water mark in
  tools/feature_sprawl.json — the same mechanism as the flash budget, for
  entanglement. A site added to a shared file fails; extracting a feature into
  its own translation unit (the P2 goal) lowers the mark. The starting
  scoreboard is 283 sites across 24 macros (SIMUT_AIR 41/15,
  SIMUT_DISPLAY_TFT 39/20, SIMUT_SENSOR_DS18B20 35/13, SIMUT_CLI_FULL
  34/9, SIMUT_PANEL_PIN 27/13). It runs in the CI gates job.

This establishes the discipline; the actual seam extractions (a translation
unit per feature type, which will make that scoreboard drop) are follow-up PRs.

Not in this PR (deliberately)

• simut_features.h (feature macros as a generated header for the code's
  #if) — belongs with the first P2 seam.
• The dead runtime knobs s_int and loggingEnabled — removing a user-facing
  control is a product decision.
• Guarding the ghost routes (/api/reset_touch_cal, /api/themes) under TFT —
  changes the alpha/air image, better reviewed on its own.
• The P2 seam extractions themselves — each its own PR, each dropping the
  entanglement scoreboard.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jq4auDQppGzmAx1gLKn1z3