fix: cache security info from ROM before stub loads

GET_SECURITY_INFO (0x14) is ROM-only; stub returns 0xC0. Cache the
response during detectChip() and return it from readSecurityInfo().

When stub is loaded and no cached info is available, return
UnsupportedCommandError with guidance to use ChipAuto.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jgangemi

pkg/espflasher/security_info.go

@@ -37,6 +37,14 @@ func (f *Flasher) readSecurityInfo() (*SecurityInfo, error) {
 	if len(f.secInfo) > 0 {
 		res = f.secInfo
 	} else {
+		// GET_SECURITY_INFO (opcode 0x14) is ROM-only; stub returns 0xC0.
+		// If stub is loaded and we have no cached info, it's too late.
+		if f.conn.isStub() {
+			return nil, &UnsupportedCommandError{
+				Command: "GET_SECURITY_INFO requires ROM bootloader; not available after stub is loaded (use ChipAuto to cache during connect)",
+			}
+		}
+
 		res, err = f.conn.securityInfo()
 		if err != nil {
 			return nil, err

pkg/espflasher/security_info_test.go

@@ -323,3 +323,34 @@ func TestSecurityInfoCachingWithStubFailure(t *testing.T) {
 		t.Errorf("expected only 1 connection call (second should use cache), got %d", callCount)
 	}
 }
+
+func TestSecurityInfoStubWithoutCache(t *testing.T) {
+	// Test that when stub is running and no cached security info is available,
+	// readSecurityInfo() returns UnsupportedCommandError.
+	mc := &mockConnection{
+		securityInfoFunc: func() ([]byte, error) {
+			return nil, errors.New("stub does not support command 0x14")
+		},
+		stubMode: true, // Simulate stub is running
+	}
+	f := &Flasher{conn: mc}
+
+	// Call without cache and stub running should return UnsupportedCommandError
+	si, err := f.readSecurityInfo()
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+
+	var unsupErr *UnsupportedCommandError
+	if !errors.As(err, &unsupErr) {
+		t.Fatalf("expected UnsupportedCommandError, got %T: %v", err, err)
+	}
+
+	if unsupErr.Command != "GET_SECURITY_INFO requires ROM bootloader; not available after stub is loaded (use ChipAuto to cache during connect)" {
+		t.Errorf("unexpected error message: %s", unsupErr.Command)
+	}
+
+	if si != nil {
+		t.Errorf("expected nil SecurityInfo, got %v", si)
+	}
+}