Wire ESP-IDF's built-in 150-CA root bundle to the OTA HTTP client so HTTPS OTA verifies server certificates. Pin bundle config in sdkconfig.defaults. Replace dead artifact-copy step with Gitea release creation on tag push. Bump CI container to IDF v5.5.