0.3.0 — Cooperative Lifecycle + Emergency Stop

Safety/lifecycle rework. Closes the issue #21 freeze at the root and adds
an emergency stop. Compile-verified (all examples), 15/15 host tests, and
emergency stop verified on hardware.

What's new

• Cooperative single-task lifecycle — no per-phase vTaskDelete; user
  code is never killed mid-transaction, so a Wire/malloc lock can't be
  orphaned (the issue #21 root cause). Wedged loops fail halt-safe (inputs
  zeroed, held safe, no reboot).
• Emergency stop — red UI button / cmd=estop: kills the user task,
  runs robotEnd() under a watchdog, and locks the robot until reboot.
  Optional hardware kill line via PROBOT_ESTOP_ENABLE_PIN.
• Status LED is status-only + new PROBOT_RSL_PIN (FRC-RSL-style signal
  light: blinks while the robot can move, solid otherwise).
• New macros: PROBOT_LOOP_DEADLINE_MS, PROBOT_WDT_TIMEOUT_S,
  PROBOT_ESTOP_END_MS, PROBOT_ESTOP_ENABLE_PIN, PROBOT_RSL_PIN.

Breaking changes

• probot::devices::Servo removed — drive servos with raw LEDC; see
  examples/ServoTest.
• builtinled::setColor/set/setBrightness removed — the LED is library-driven.
• Stop now takes effect at the next loop boundary; a wedged autonomous no
  longer auto-switches to teleop (it falls to halt-safe).

The loop contract (important)

Every teleopLoop/autonomousLoop iteration must return — no infinite
loops, bound your blocking calls (e.g. Wire.setTimeOut(50) for I2C).

Full details in CHANGELOG.md.