Replace IDF base image with bare Debian, remove CodeQL, fix GCC 14 build errors

[SukuWc]

Summary

• Replace official ESP-IDF Docker base image (espressif/idf:v5.5) with bare debian:trixie + manual ESP-IDF v5.5 installation, scoped to esp32s3 only for a smaller image
• Remove CodeQL from Docker image, CI workflow (codeql_intech.yml), helper script (fail_on_error.py), and .gitignore
• ROM log early boot crash workaround: Setting CONFIG_BOOT_ROM_LOG_ON_GPIO_HIGH=y in sdkconfig triggers an ESP-IDF bug that crashes on boot when the eFuse is already burned — the IDF startup code handles ESP_ERR_NOT_SUPPORTED but not ESP_ERR_INVALID_STATE. The fix was reportedly merged upstream but never made it to the main branch. Instead of patching IDF source in Docker, we now set sdkconfig to CONFIG_BOOT_ROM_LOG_ALWAYS_ON=y (default) and call esp_efuse_set_rom_log_scheme(ESP_EFUSE_ROM_LOG_ON_GPIO_HIGH) directly in firmware with proper error handling for all return codes. The patch_esp_efuse_startup.sh Docker patch is removed.
• Update bootloader binaries
• Fix all D51 build errors caused by stricter GCC 14 (from Debian trixie's gcc-arm-none-eabi 14.2):
  • Add missing #include <assert.h> across 10 files in grid_common/
  • Add missing #include <stdlib.h> in grid_transport.c, grid_port.c, grid_config.c
  • Add missing #include <stdio.h> in startup_samd51.c, grid_d51_usb.c
  • Fix implicit function declarations by adding missing includes (grid_d51.h, grid_d51_uart.h, grid_d51_usb.h, grid_module.h, usb_start.h)
  • Fix incompatible pointer types: i2c_m_async_transfer, _dma_set_source_address, hiddf_keyboard_keys_state_change, adc_async_read_channel, callback signatures for ADC and SPI
  • Fix GRID_D51_USER_ROW_BASE int-to-pointer cast
  • Fix forward declarations for tx_cb_USART_GRID, dma_transfer_complete
  • Fix volatile dmatest missing type specifier
  • Fix grid_cal_next missing return statement
  • Fix grid_led_startup_animation extra address-of operator
  • Fix luaL_Reg initializer missing braces
• Fix Dockerfile reliability: split monolithic RUN into separate layers, use apt-get instead of apt for non-interactive compatibility
• Update patch_esp_trace_include.sh to use $IDF_PATH with guard check instead of hardcoded /opt/esp/idf/
• Fix GUI/WASM build: use emcmake cmake for proper Emscripten toolchain setup

Testing

Docker image

• Rebuild Docker image from scratch (--no-cache)
• Verify gcc-arm-none-eabi, emcc, and idf.py are available in container

Firmware builds

• D51 build (d51_build_firmware.sh)
• ESP32 build (esp_build_firmware.sh)
• Pico build (pico_build_firmware.sh)
• GUI/WASM build (gui_build.sh)

ROM log workaround with fresh boards

• First boot on fresh chip (eFuse not yet burned)
• Subsequent boots (eFuse already burned to GPIO_HIGH)
• Verify ROM logs are suppressed after first boot

ROM log workaround with known incorrectly configured boards

• Boot on board with eFuse burned incorrectly to GPIO_LOW
• Verify that board boots with the current firmware build