feat: ship TokenLink 0.2.1 C152 monorepo release

[phantom5125]

Summary

• move the default wireless M5Stack StopWatch C152 firmware, pinned build, tests,
  licenses, and release packaging into the TokenLink repository
• ship the protocol-v2 watch face at boot, with v1 retained only after a valid
  legacy payload
• standardize the Mac product identity as app.tokenlink, require an explicit
  one-time Bluetooth rebind, and wait for the C04 subscription before reporting
  protocol v2 ready
• keep Claude disabled by default, explain Keychain access before requesting it,
  and make migration of TokenLink-owned legacy credentials explicit
• add checksummed Mac development and C152 firmware artifacts plus the
  tag-triggered v0.2.1 prerelease workflow

Related issue

Not required — release integration and verified fixes.

Scope

• Small bug fix
• Tests or documentation
• Approved feature
• Provider adapter
• Hardware, firmware, transport, or protocol adapter

Verification

• swift build
• bash scripts/test.sh — 177 tests passed
• swift format lint --strict Package.swift
• swift format lint --recursive --strict Sources Tests
• bash scripts/privacy_scan.sh
• ten host-native firmware test executables and the ESP32-S3 release build
• firmware packager tests, Mac/firmware contract check, and generated SHA-256
  verification

Real-world evidence

On 2026-08-30, the final code candidate e155c5d was installed as TokenLink
0.2.1 build 3 and flashed to an M5Stack StopWatch C152. The flash verified every
image segment and the serial probe observed BLE v2, C01-C04, and
CODEX_MICRO_STOPWATCH_READY.

The maintainer then completed the physical acceptance checklist: direct v2
presentation at boot, explicit Bluetooth authorization/rebind under the new app
identity, live quota sync, watch refresh, reconnect, page interaction, and
session-to-Codex task focus all passed. The PR-tip commit after that acceptance
only records the evidence in documentation. Device identifiers and private
payloads are intentionally omitted. The 24-hour power soak remains follow-up
evidence.

Security and privacy

• No secret, private payload, personal path, or device ID is included.
• New credential-bearing endpoints use an explicit HTTPS host allowlist.
• User-facing and contributor documentation is updated.

Claude credential access is disabled until the user explicitly enables Claude
and continues after reading the authorization scope. Existing TokenLink-owned
credentials are not migrated until the user separately confirms the one-time
migration.

AI or agent assistance

OpenAI Codex assisted with implementation review, automated verification,
packaging, and release preparation. The maintainer reviewed the behavior and
completed the physical-device acceptance.

Contributor checklist

• I read and will follow the Code of Conduct and contributing guide.
• I understand every submitted change and have the right to license it.
• The change is focused and avoids unrelated refactoring or formatting.
• Tests and evidence demonstrate the behavior claimed in this pull request.