Support atomic two-packet signed fleet commands

Automatically split longer signed envelopes into two bounded group-data packets, reserve both before queueing, and roll back exact packet copies and retries on admission failure. Collect fragments in either order with a fixed deadline and verify the complete command before durable replay reservation and dispatch.

Raise whole-fleet protocol capacity to 230 bytes, preserve target-specific budgets and radio acknowledgement barriers, and reject rule-token and USB rescue-line truncation. Document existing app input limits and add real-signature, sanitizer, queue failure, timeout, replay, and compact-board regressions.

test/fixtures/companion_fleet_dispatch.h

@@ -23,7 +23,7 @@
 namespace mesh {
 struct FleetCommand {
   static constexpr uint16_t DataType = 0xFF01;
-  static constexpr size_t KeySize = 16, TargetSize = 16, MaxPayloadLength = 165;
+  static constexpr size_t KeySize = 16, TargetSize = 16, MaxPayloadLength = 165, MaxEnvelopeLength = 308;
   static constexpr uint32_t MinEpoch = 1735689600UL, MaxLifetime = 600;
   struct Targets { uint8_t length = 0, count = 0, data[86] = {}; };
   static bool parseTargets(const char*, size_t, Targets&) { return false; }
@@ -52,4 +52,8 @@ struct CompanionFleetFixture {
     assert(false && "fleet packet admission belongs in its dedicated suite");
     return false;
   }
+  bool sendFleetCommandData(FleetFixtureChannel&, const uint8_t*, size_t) {
+    assert(false && "fleet packet admission belongs in its dedicated suite");
+    return false;
+  }
 };