add rpi-loader-ota, the shared OTA bundle container

[joeferner]

A new package in ota/, published separately: the over-the-air update bundle format, no_std, meant to be linked by both the tool that builds a bundle and the firmware that installs one. A wire format described in two places is one that has already drifted, and this one had — the two implementations it was collected from agreed on every byte and disagreed on what they enforced, each accepting bundles the other rejected.

The container is version 2 of that format and a clean break from version 1, which carried a kernel plus a flat list of names the device wrote into one hardcoded directory. It is now a list of (path, role, bytes) under a CRC-32, so an update can replace anything on a boot partition — a settings file, a firmware blob, a certificate, config.txt, the Raspberry Pi firmware itself — rather than a kernel and some assets.

Reading allocates nothing: Bundle::parse validates in place and borrows, so a device holds the upload and nothing else. The alloc feature is the encoder alone, and apply, which will carry the install half, is gated behind resident-fat.

Both directions run the same rules, which is the point: a packer cannot build what a device would reject.

Releasing: ota/ versions independently of the CLI and the firmware, which ship as one release because they are halves of a wire protocol. This is a library whose consumers are firmware projects elsewhere, and a renamed flag here is no reason to bump their dependency. It gets its own changelog and its own ota-v* tag; release.yml gates the two jobs on tag prefixes that cannot both match.