Harden marathon-tested OTA and hardware paths

Add durable TempRadio, ACL, clock, bridge, GPS/I2C, USB logging, and Indicator recovery safeguards together with expanded automation, build/profile contracts, release metadata, and the hardware validation ledger.

scripts/generate_cert_bundle.py

@@ -15,22 +15,40 @@ from __future__ import with_statement
 
 from pathlib import Path
 import os
-import struct
-import sys
-import requests
-from io import open
-
-Import("env")
-
-try:
-    from cryptography import x509
-    from cryptography.hazmat.backends import default_backend
-    from cryptography.hazmat.primitives import serialization
-except ImportError:
-    env.Execute("$PYTHONEXE -m pip install cryptography")
-    from cryptography import x509
-    from cryptography.hazmat.backends import default_backend
-    from cryptography.hazmat.primitives import serialization
+import struct
+import sys
+import warnings
+import requests
+from io import open
+
+Import("env")
+
+try:
+    from cryptography import x509
+    from cryptography.hazmat.backends import default_backend
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.utils import CryptographyDeprecationWarning
+except ImportError:
+    env.Execute("$PYTHONEXE -m pip install cryptography")
+    from cryptography import x509
+    from cryptography.hazmat.backends import default_backend
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.utils import CryptographyDeprecationWarning
+
+
+# Common platform trust stores still contain serial-zero roots. ESP-IDF's
+# bundle generator suppresses this narrowly while pyca retains parsing support:
+# https://github.com/espressif/esp-idf/blob/master/components/mbedtls/esp_crt_bundle/gen_crt_bundle.py
+# https://github.com/pyca/cryptography/issues/12948
+warnings.filterwarnings(
+    "ignore",
+    message=(
+        r"^Parsed a serial number which wasn't positive \(i.e., it was negative or zero\), "
+        r"which is disallowed by RFC 5280\. "
+        r"Loading this certificate will cause an exception in a future release of cryptography\.$"
+    ),
+    category=CryptographyDeprecationWarning,
+)
 
 
 ca_bundle_bin_file = 'x509_crt_bundle.bin'