[build] Select the v0.4.2 qualification baseline

[yyods]

Summary

• bind the runtime agent version to the canonical release lock and select 0.4.2
• specify, test, and implement mechanical OI1 baseline/HIL evidence assembly
• stabilize the Android Blockly example action after the real IME is dismissed
• preserve the fail-closed two-profile release process (esp32-4mb, esp32-s3-n16r8; C3 remains deferred)

This is phase A only. Formal reproducible builds and hardware baseline measurements will start from the canonical protected-main SHA after this PR is rebased and merged. No firmware artifact is published by this PR.

Local verification

• tests/firmware_tests/run_tests.sh: 23 files, 0 failed
• full firmware host discovery: 385 tests passed, 19 intentional skips
• focused release suite: 107 tests passed
• flutter analyze --no-pub: passed
• dart format: passed
• git diff --check main...HEAD: passed

Release sequencing

After protected merge, sync clean main, create two fresh three-target build roots, prove byte-for-byte reproducibility, stage only the two qualified installer profiles, flash and measure both owned boards, then commit mechanically assembled OI1 evidence in a separate protected PR.