variants/linux: validate meshcored.ini, and stop hiding failures at startup

[mmmorks]

Staged on the fork for review. Final destination: l5yth/meshcore-linux linux. Base here is pr/01-build-tooling so the diff shows only this change.

Summary

The INI loader parsed every value with atoi()/atof() and silently dropped anything it did not understand, so a misconfigured node started up looking healthy and failed later in a way that read as a hardware fault. This makes every problem visible at startup and refuses to start on the ones that cannot be honoured.

What changed

• LinuxConfig::load() returns a LoadResult that separates two failure kinds, because they deserve opposite responses:
  • An invalid value is fatal. dio2_as_rf_switch = true used to become false (leaving TX dead on boards that need the RF switch); lora_irq_pin = 260 wrapped to line 4 through pin_size_t; lora_freq = 868,5 became 868.0. There is no sensible fallback for "which GPIO drives the radio", so the daemon now says which line is wrong and exits.
  • An unknown key only warns. It is inert by definition and may come from a newer or older build, so refusing to boot over it would take a working repeater off-air for a line it was already ignoring. It is still said out loud, because the radio parameters are first-run defaults that get persisted on the first boot: lora_frequency for lora_freq did not merely fail to apply, correcting the INI afterwards did not undo it.
  • A file that cannot be opened at all is now distinguishable from one that was read.
• Parsing: booleans accept 1/0, true/false, on/off, yes/no; pins are range-checked against 0..255; integers against their field's width; floats must parse to the end of the value. Also handled: an overlong line (which fgets() used to split into a truncated setting plus a bogus unknown key), a UTF-8 BOM gluing itself to the first key, [section] headers, a line with no =, and a duplicate key (which leaked the previous safe_copy() allocation). The string fields become const char* since they may point at literals.
• reboot() re-execs the process via the ardulinux core's ::reboot() instead of exit(0). The shipped unit uses Restart=on-failure, so a clean exit is a stop, not a restart, and reboot/clkreboot reach this from a remote admin over the mesh, which took an unattended node off-air.
• LinuxRTCClock::setCurrentTime() reports what happened. Setting the host clock needs CAP_SYS_TIME, which the unprivileged unit does not have, so clock sync and GPS time sync were reporting success and doing nothing. A failure is now warned about once; a successful set is logged every time so a clock fighting NTP is visible in the journal.
• The placeholder Module built at static init (before the pins are known) is freed when radio_init() rebuilds the radio, rather than leaked.
• startup_reason is set to BD_STARTUP_NORMAL; nothing initialised it before.
• README: a "Config validation" subsection and the accepted boolean spellings.

How it was tested

• The loader was run in an arm64 container against 20 crafted config files, with a harness that checks each case in both directions (whether startup reached the SPI stage), so a warning that silently became fatal fails and so does a fatal that silently became a warning; all three shipped templates still validate. radio_init() was confirmed to reach the delete/reassign path in the same container.
• On this branch as submitted: arm64 build in Docker succeeds; pio test -e native passes (no tests are added here; the loader has no host-side harness in the tree).
• reboot() and the clock-set diagnostics follow from the shipped unit (Restart=on-failure, unprivileged user, NoNewPrivileges=yes); those two changes were verified by build, not by a dedicated test.

Dependencies

Based on the build-tooling PR (only so the native suite compiles on macOS); no code dependency.

Shared code touched

None (all under variants/linux/).