Add signed private fleet controls for filtering and secondary radio

Enroll a private channel and publisher public key on repeaters and room servers. Local Companion fleet sends sign targeted or whole-fleet commands, with expiry, durable replay protection, and a restricted command allowlist. Preserve exact transmitted-reply barriers for secondary-radio changes, bound validation and replies, and qualify crypto, persistence, transport scope, role permissions, and compact-profile exclusions with regression tests.

.github/workflows/run-unit-tests.yml

@@ -101,6 +101,13 @@ jobs:
       - name: Run Unit Tests
         run: pio test -e native -e native_kiss_modem -e native_ota_channel -vv
 
+      - name: Verify signed private fleet management
+        run: |
+          python3 -B test/test_fleet_command_crypto.py -v
+          python3 -B test/test_companion_fleet_control.py -v
+          python3 -B test/test_fleet_channel_runtime.py -v
+          python3 -B test/test_fleet_role_wiring.py -v
+
       - name: Verify OTA channel persistence and published image tags
         run: |
           python3 -B test/test_ota_channel_persistence.py -v