B3: pin lib_deps to the recorded manifest #185

_{Recreated from Strycher/Field_Compass-archive#185 — originally opened by @Strycher on 2026-08-09. Credentials redacted where present.}

Epic: #154

Pin every library to docs/library-manifest.md (#159) - versions captured from arduino-cli's own resolution during a real build, not from lib list.

Why exact pins, not ranges

Unpinned drift is what broke this project. The source was untouched from 2026-03-02 to 2026-08-09 and went from building to not linking at all (#164). Ten dependencies ship with the ESP32 core, so B1's platform pin covers those; the other 15 need explicit pins.

Key versions: lvgl@9.5.0, TFT_eSPI@2.5.43, bsec2@1.10.2610, BME68x Sensor library@1.3.40408, the Adafruit stack, RTClib@2.1.4.

Watch for

SD.h resolves to two libraries under arduino-cli - the core's 3.3.8 and a stray sketchbook SD 1.3.0. The core one is correct and is chosen implicitly today. Make it explicit so it cannot flip.

Acceptance criteria

• pio run compiles with all deps at exact versions
• No "Multiple libraries were found" warnings
• Any version differing from the manifest is documented with the reason