[boburning]

Program and dependency

• Implements the rendered scan portion of NET-05 from the v3 work program.
• Depends on merged PRs NET-05A: add credential-free Wi-Fi UI model #545, feat(network): route Wi-Fi controls to safe details (NET-05) #546, feat(network): add nonblocking Wi-Fi scan client (NET-05) #547, and feat(network): sequence bounded Wi-Fi scans (NET-05) #548.
• Base: current main at 9b3a847d99daf8baf44d953670d0ff4a18562a60.
• Tracks NET-05: replace direct Wi-Fi toggle with bounded profile UI #544.

Summary

• Adds one selectable Scan/Cancel row to Bloom Shell's bounded Wi-Fi detail surface.
• Drives the existing single-flight scan controller from an active-only 100 ms SDL wake, never from draw().
• Renders successful scan results as bounded, read-only SSID/security/signal rows.
• Cancels an in-flight scan when the panel closes and defers GameSwitcher until the exact operation is terminal and discarded.
• Hardens close-during-results behavior by discarding the already-terminal service operation rather than issuing an invalid cancel.
• Updates the typography authority, security/development architecture, test matrix, and v3 ledger evidence.

Validation

Local focused gates on d34af346:

• clang-format-21 --dry-run --Werror on changed C/C++: pass.
• strict Linux production syntax (gcc -Wall -Wextra -Werror ... -fsyntax-only main.c bloom_shell_wifi_ui.c): pass.
• Bloom typography authority and exact Shell call-site validation: pass (82 copy, 14 mixed).
• native affected selector BloomUiTypography*:BloomShellWifiUi*:BloomShell*:BloomFrontend*: 184/184 pass in 3.558 s.
• AddressSanitizer focused selector BloomShellWifiUi*:BloomUiTypography*: 20/20 pass in 590 ms.
• exact affected shell selector: 106/106 pass, including canonical manifest, provenance, transfer-policy, and dependency-inventory preflight on the first run.
• exhaustive cppcheck on the small changed Wi-Fi module: pass; strict compilation covers the large event-loop translation unit locally, while the repository's risk-scoped static job remains authoritative for the affected directories.
• v3 ledger JSON parse and git diff --check: pass.

CI on 3f3f87fe passed every required gate:

• format: 40 s
• affected shell tests: 50 s
• AddressSanitizer: 1 min 10 s
• affected ARM Bloom Shell build: 1 min 22 s
• native tests: 1 min 30 s
• scoped static analysis: 2 min 03 s

Device evidence and limitations

• No device deployment or mutation was performed for this PR. The Mini Plus remains on its known-good signed baseline, online and associated.
• No reboot, signed update, Hot/Warm sync, Wi-Fi toggle, profile mutation, listener/key mutation, or association was attempted.
• This slice does not add connect, credential entry, forget, or radio-power actions. Discovered networks are intentionally read-only.
• Host tests do not certify physical controls, LCD presentation, real scan backend behavior, association, roaming, shutdown, or recovery on Mini/Plus/Flip hardware.
• No credentials are accepted, displayed, logged, persisted in Shell state, or captured as evidence.

Closes no issue; contributes to #544.