NET-03 — Wi-Fi secret profile store #484

Tracks NET-03 in the authoritative v3 work program after merged NET-02 (#483).

Acceptance scope:

• one bounded Bloom-owned authority for Wi-Fi secrets
• atomic projection to the runtime supplicant configuration
• WPA2-PSK, explicit open networks, and manual hidden WPA2 where practical
• no WEP and no automatic arbitrary open-network connection
• secret material enters through stdin or another fixed private boundary, never arguments
• no SSIDs or keys in logs, status output, screenshots, fixtures, or support evidence
• symlink/path/permission/count/size validation and failure-safe previous-config preservation
• focused host fixtures before any read-only or safe device evidence

This issue does not authorize a sole-route Wi-Fi-off test, mutation of the only automation key, or unsupported product expansion. Mini Plus evidence remains distinct from Mini V1-V4 and Mini Flip/my285 certification.

Parent program: #434