build: move to pioarduino 55.03.312 (Arduino 3.3.12, ESP-IDF 5.5)

IDF 4.4 gets no more security fixes, and the planned RMT radio needs
IDF 5's RMT driver.  See docs/adr/0003-pioarduino-idf55.md.

- Every env on one pinned pioarduino release.  C6 drops its own
  library list and flags but stays a debug build on huge_app.
- Release envs build at CORE_DEBUG_LEVEL=2 so the ESP32 image fits its
  1.5 MB OTA slot (17 KB free); debug envs stay at 3.
- Drop the C3: its image is 76.5 KB over the OTA slot on IDF 5.5.
- CI installs pioarduino's Core and checks firmware.bin against the app
  partition, failing under 8 KB free.  PlatformIO's "Flash:" figure
  reads ~45 KB low and passed a C3 image that doesn't fit.
- esp_task_wdt_reconfigure(): on 3.x the core already starts the watchdog
  and esp_task_wdt_init() fails, so the C6 build kept the 5 s default.
- An updated firmware is kept only once it has run 60 s with the
  network up; a reset before then rolls back to the previous one.
- ETH.begin() takes the 3.x argument order; Arduino 2.x branches gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/SomfyController.ino

@@ -16,18 +16,20 @@
 #include "GitOTA.h"
 #include "esp_core_dump.h"
 #include "esp_system.h"
-#include "esp_idf_version.h"
-#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 0, 0)
 #include "esp_app_desc.h"
-#define getRunningElfSha esp_app_get_elf_sha256
-#else
 #include "esp_ota_ops.h"
-#define getRunningElfSha esp_ota_get_app_elf_sha256
-#endif
 #include "Timing.h"
 
 static const char *TAG = "Main";
 #define LOOP_SLOW_MS 100
+// How long an updated firmware has to run, and then have the network up, before
+// it is kept.  A reset before then rolls back to the previous firmware.
+#define OTA_PROVEN_MS 60000
+
+// Overrides the core's weak hook so it leaves an updated firmware unverified
+// at boot.  loop() confirms it once otaProven().
+extern "C" bool verifyRollbackLater() { return true; }
+static bool otaPending = false;
 
 ConfigSettings settings;
 Web webServer;
@@ -101,7 +103,7 @@ void setup() {
     static_assert(sizeof(crashedSha) <= sizeof(summary.app_elf_sha256), "copy would read past app_elf_sha256");
     SETCHARPROP(crashedSha, (const char *)summary.app_elf_sha256, sizeof(crashedSha));
     char runningSha[APP_ELF_SHA256_SZ] = {0};
-    getRunningElfSha(runningSha, sizeof(runningSha));
+    esp_app_get_elf_sha256(runningSha, sizeof(runningSha));
     if(strcmp(crashedSha, runningSha) == 0)
       CRASH_LOG("  Build: %s (running %s, same build)", crashedSha, runningSha);
     else
@@ -129,14 +131,15 @@ void setup() {
   net.setup();  
   somfy.begin();
   //git.checkForUpdate();
-#if ESP_ARDUINO_VERSION_MAJOR >= 3
+  // The core starts the watchdog with a 5s timeout before setup(), so
+  // esp_task_wdt_init() would fail and keep that.
   const esp_task_wdt_config_t wdt_config = { .timeout_ms = 15000, .idle_core_mask = 1, .trigger_panic = true };
-  esp_task_wdt_init(&wdt_config);
-#else
-  esp_task_wdt_init(15, true); //enable panic so ESP32 restarts
-#endif
+  esp_task_wdt_reconfigure(&wdt_config);
   esp_task_wdt_add(NULL); //add current thread to WDT watch
-
+  esp_ota_img_states_t otaState;
+  otaPending = esp_ota_get_state_partition(esp_ota_get_running_partition(), &otaState) == ESP_OK &&
+    otaState == ESP_OTA_IMG_PENDING_VERIFY;
+  if(otaPending) ESP_LOGW(TAG, "Updated firmware, keeping it once it has run %ds with the network up", OTA_PROVEN_MS / 1000);
 }
 
 void loop() {
@@ -183,6 +186,11 @@ void loop() {
     net.end();
     ESP.restart();
   }
+  if(otaPending && otaProven(net.connected(), millis(), OTA_PROVEN_MS)) {
+    otaPending = false;
+    if(esp_ota_mark_app_valid_cancel_rollback() == ESP_OK) ESP_LOGI(TAG, "Updated firmware confirmed, rollback cancelled");
+    else ESP_LOGE(TAG, "Unable to confirm the updated firmware");
+  }
   esp_task_wdt_reset();
   loopStats.record(pass.us());
 }