[boburning]

Program and dependency

• Continues NET-05 from the v3 work program.
• Depends on merged PR feat(network): render bounded Wi-Fi scans (NET-05) #549 and its merged NET-05/NET-04/UI-05 ancestry.
• Base: current main at 6c277d2300494ba8387accbf4bc28f4459640509.
• Tracks NET-05: replace direct Wi-Fi toggle with bounded profile UI #544.

Summary

• Adds a host-only open/WPA2 Wi-Fi profile form model using the shared bounded keyboard.
• Validates exact profile-ID, printable SSID, security, hidden-network, and WPA2 passphrase rules before creating a child.
• Masks every entered password byte in display copy.
• Invokes only fixed bloomctl network profile upsert ID arguments without a shell and sends one escaped profile document on stdin.
• Redirects child output away from the UI boundary, bounds execution to five seconds, and kills the exact process group on timeout.
• Explicitly clears both the password buffer and temporary JSON document on every validation, pipe, fork, setup, execution, and timeout path.
• Tightens the existing credential-free profile parser to match the schema's alphanumeric first-character rule.

Validation

Local focused gates on bb8bf71a:

• clang-format-21 --dry-run --Werror: pass.
• strict Linux C syntax with -Wall -Wextra -Werror: pass.
• native BloomShellWifiUi*: 11/11 pass, 386 ms focused runtime.
• AddressSanitizer BloomShellWifiUi*: 11/11 pass, 547 ms focused runtime.
• exact shell selector: 58/58 pass (25 network tests plus 33 platform/core/critical-surface tests); canonical manifest, provenance, transfer-policy, and 314,683,965-byte dependency preflight passed.
• exhaustive warning/style/performance/portability cppcheck on the changed Wi-Fi module: pass in 7.8 s.
• v3 ledger JSON parse and git diff --check: pass.

CI on 003bc467 passed every required gate:

• format: 23 s
• complete affected shell selector: 46 s
• native tests: 1 min 11 s
• AddressSanitizer: 1 min 17 s
• affected ARM Bloom Shell build: 1 min 23 s
• scoped static analysis: 2 min 22 s

Device evidence and limitations

• No device deployment or mutation was performed. The Mini Plus remains on its known-good signed baseline, online and associated.
• The form has no rendered/runtime consumer in this slice; its submit helper cannot be reached from Bloom Shell.
• No real credential was used. Tests use temporary synthetic fixture strings and remove their files.
• This slice does not scan, associate, project a profile, restart Wi-Fi, change Wi-Fi power, forget a profile, alter a listener/key, reboot, or install an update.
• The tested submit helper is synchronous by design while unreachable; a separate nonblocking controller is required before UI integration.
• Host tests do not certify physical controls, LCD presentation, real credential entry, association, roaming, or recovery on Mini/Plus/Flip hardware.

Closes no issue; contributes to #544.