Port S620 16K: guarded /experimental protocol bring-up

[catears124]

Adds the first hardware-testable Gaomon S620 (16K) port while keeping it completely isolated from the production installer.

Isolation guarantee

• production app/page.tsx is byte-identical to main;
• production lib/devices/registry.ts is byte-identical to main and ADAPTERS remains [s620];
• production README is unchanged;
• no new link/navigation points to the experiment;
• the only web entry point is the unlinked /experimental route;
• all S620 16K code lives under app/experimental, lib/devices/s620-16k, or the dedicated experimental writer module.

What this PR does

• pins the exact GM001_T263_260527 16K stock application and first test-unit full-backup hashes;
• relocates the existing runtime from 0x0800cc00 to safe erased space at 0x0800d000;
• rebases only verified external branches with exact instruction/preimage checks;
• exposes only a dedicated /experimental route; the 16K adapter is not added to ADAPTERS and the normal installer cannot select it;
• enables only the vendor feature-report protocol path for the first bring-up: three feature-report hooks plus the report-length descriptor byte;
• advertises only LiveConfig during the test; no persistence or loop-timing capability is claimed;
• leaves polling/timing, smoothing, averaging, barrel-button acceleration and pen acquisition untouched.

Guarded hardware-test sequence

1. Read the entire 128 KiB flash twice and require byte identity.
2. Require the exact pinned stock application and exact known test-unit full-flash SHA-256.
3. Build the candidate and prove that the only changed flash pages are the relocated-runtime pages plus 0x0800b800 and 0x0800c400.
4. Require the user to download the exact pre-test recovery backup before writes unlock.
5. Stage the runtime into erased 0x0800d000 space without any erase. Nothing branches to it yet, so a partial stage is inert. Read it back byte-for-byte, including blank trailing bytes.
6. Close DFU and require a fresh physical DFU entry before activation so no erase follows programming in one DFU session.
7. Re-read the staged runtime and both complete stock activation pages immediately before erase; refuse on any mismatch.
8. Erase and blank-check only 0x0800c400 and 0x0800b800 before the first program operation.
9. Program the descriptor-change page first and the executable feature-report hook page last; verify both complete pages byte-for-byte.
10. Reboot normally and run read-only WebHID checks: 32-byte feature framing, GET_INFO, GET_CONFIG, exact model/firmware IDs, minimal LiveConfig capability, and observation of unchanged pen report 0x08 traffic.

Recovery

/experimental can load only the exact pinned pre-test backup for recovery. On a fresh DFU session it erases every page the experiment can touch, restores the original non-blank stock pages, leaves the originally-erased runtime pages erased, and verifies every restored page.

The resident DFU bootloader is never erased or programmed. A live flash still has irreducible transaction risk (for example, power loss during an erase/program operation), so this is designed to be maximally conservative and DFU-recoverable rather than claiming literal zero risk.

Still intentionally blocked

Production support still waits on hardware success here, 16K-specific smoothing semantics, a separately measured timing/rate model, pressure/button/proximity validation, and a production restore policy. The old S620 294-530 Hz measurements are not reused.