feat: OTA TLS cert verification + CI release pipeline

Wire ESP-IDF's built-in 150-CA root bundle to the OTA HTTP client
so HTTPS OTA verifies server certificates. Pin bundle config in
sdkconfig.defaults. Replace dead artifact-copy step with Gitea
release creation on tag push. Bump CI container to IDF v5.5.

TODO.md

@@ -11,7 +11,7 @@
 - [ ] Flash encryption planning (irreversible eFuse burn)
 - [ ] Secure Boot V2 planning (irreversible eFuse burn)
 - [ ] DTLS for UDP command channel (stretch goal)
-- [ ] OTA certificate pinning / embedded CA cert
+- [x] OTA TLS certificate verification (ESP-IDF CA bundle)
 - [ ] NVS encryption for auth_secret at rest
 
 ### Features