feat(lab): identify, discover, ping, log-tail, sleep commands

Adds the iteration-loop tools the operator needs to test firmware
without leaving lab-mode for any side-channel:

- identify: CDC HELLO, returns fw triple + board + creds_present +
  wifi_joined. Quick check after a flash to confirm the Pico booted
  and what state it's in.
- discover: UDP broadcast on 4242 with a bounded timeout. Returns the
  first ACK so the operator knows the runtime IP / uid without
  trusting last_pico.last_ip.
- ping: nonce + host wall-clock round-trip. Latency / liveness check
  that does not touch the Pico.
- read_state_journal / read_bridge_log: tail of either log file with
  a 200-line default and 2000-line hard cap. Path is one of two known
  values; no arbitrary file read.
- sleep: bounded (60 s max) await so scripted sequences like
  "force_bootsel -> sleep 1500 -> flash" can be one composite tunnel
  conversation instead of client-side timers.

state_snapshot now also reports wifi_vault_saved so the operator can
tell whether wifi_apply_saved will work before they ask for it.

Every new command is typed end-to-end and bounded -- no shell exec,
no arbitrary file read, no process spawn. The full surface remains
auditable in the LabCmd enum.

Author: RealWhyKnot