fix(control,render,build): port the control-server, renderer-tooling, and release-hygiene train from litclock-dev

[kapoorankush]

File-level port of the non-wifi seam of the litclock-dev #606-#631 train into the public repo, plus pre-train catch-ups earlier ports had missed. The companion PR #50 ports the wifi/provisioning seam; the two are file-disjoint and merge in either order.

What ships (dev PRs folded here)

• litclock-dev#608: the PWA update-progress UI survives the updater restarting litclock-control (busy-inference in the status route, server-rendered in-progress page, JS retry and resume).
• litclock-dev#621: a stale confirm token self-heals into a fresh confirmation instead of dead-ending, with recovery wired through system.js and updates.js.
• litclock-dev#622: no false "Connection issue" during the post-boot settling window.
• litclock-dev#628: factory reset powers off instead of rebooting (route, JS, template, litclock-reset.service).
• litclock-dev#618: build-image.yml quotes and validates ref-derived values before the sourced pi-gen config (shell-injection class on the release runner), with LC_ALL: C pinning the allowlist ranges.
• litclock-dev#611: the runtime-render marker binds to its proof inputs and OTA invalidates it on change.
• litclock-dev#614: the #605 review-polish backlog across corpus_edit, renderer, and tooling files, which also brings the deferred litclock-dev#545/#564 fitted-font-size chain to parity.
• litclock-dev#623: the sudoers 020 header no longer claims dropping 010 is safe.
• litclock-dev#624: unused qrencode dropped from the image; runtime-render branch test coverage.
• litclock-dev#631: deterministic hardware test for on-boot location reresolve (scripts/qa-reresolve-hw-test.sh), now the documented QA gate.
• Catch-ups: litclock-dev#579 (DHCP lease age no longer reports a network fault), litclock-dev#562 (image releases resolve from the device's own repo and are corpus-hash-verified before install), the litclock-dev#531 exit-finalization work in literary_clock.py with its test, and the litclock-dev#539 fs-floor warning block in tools/render_invariants.py.

Port method and verification

Per-file public..dev delta against a per-file merge base, never wholesale copies of diverged files. Every ported file verified equivalent to litclock-dev master modulo ref requalification; public-only content preserved and pinned by existing tests (the #527 sysctl persisted-file verification in update.sh, the #528 gift-mode SSH-off block in reset-setup.sh, the render-invariants docstring rewordings that point at the development repo's CI).

Review before opening caught and fixed: an HTML entity corrupted by the ref requalifier in a test assertion, the missing fs-floor block that a ported comment claimed existed, and a stale journald doc claim.

Gates on this branch's tree: ruff clean; pytest 3,163 passed with the freetype-gated tests executed locally (zero relevant skips); vitest 182 passed.

Notes for the maintainer (dev-faithful behavior, ported as-is)

• The factory-reset poweroff copy invites "pass the clock on", but the SSH-off scrub runs only in gift mode; a non-gift reset hands over a device with the owner's SSH posture. Same behavior as dev; flagged as a design question, tracked on litclock-dev.
• The new corpus-hash gate in download_images.sh will quarantine images on a device whose locally edited CSV diverges from the installed set, by design (litclock-dev#561). Verified it cannot fire on pristine devices: the public CSV sha1 matches the v9 manifest.

Fleet impact

None until a release is tagged (OTA is tag-gated). This train plus PR #50 is the substance of the planned v0.224.0.