[boburning]

Program and dependency

• Continues NET-05 from the v3 work program.
• Depends on merged PR feat(network): bound Wi-Fi credential input (NET-05) #550 and its merged NET-05/NET-04/UI-05 ancestry.
• Base: current main at 0ef8e110c0afd197b3c63a400c6e02afd0fec8f9.
• Tracks NET-05: replace direct Wi-Fi toggle with bounded profile UI #544.

Summary

• Evolves the host-only profile upsert boundary into a nonblocking start/poll request.
• Writes the bounded profile document once and clears the password and temporary JSON before start returns.
• Retains only the exact child/process-group handle, non-secret profile ID, monotonic deadline, and bounded output state.
• Captures at most 4 KiB and accepts only an exact schema-1 bloom-wifi-profiles upsert acknowledgement with a valid profile count.
• Rejects malformed/unknown/oversized responses, non-zero child exits, and five-second timeouts while killing and reaping the exact process group.
• Keeps the prior synchronous helper only as a host-test wrapper over the same asynchronous implementation; no runtime surface calls either path.

Validation

Local focused gates on 377108b5:

• clang-format-21 --dry-run --Werror: pass.
• strict Linux C syntax with -Wall -Wextra -Werror: pass.
• native BloomShellWifiUi*: 12/12 pass, 498 ms focused runtime.
• AddressSanitizer BloomShellWifiUi*: 12/12 pass, 641 ms focused runtime.
• complete affected shell selector in one invocation: 58/58 pass; canonical manifest, provenance, transfer-policy, and 314,683,965-byte dependency preflight ran once and passed.
• exhaustive warning/style/performance/portability cppcheck on the changed Wi-Fi module: pass.
• v3 ledger JSON parse and git diff --check: pass.

CI on 8040250c passed every required gate:

• format: 14 s
• complete affected shell selector: 50 s
• AddressSanitizer: 1 min 15 s
• native tests: 1 min 20 s
• affected ARM Bloom Shell build: 1 min 23 s
• scoped static analysis: 2 min 18 s

Device evidence and limitations

• No device deployment or mutation was performed. The Mini Plus remains on its known-good signed baseline, online and associated.
• There is still no rendered/runtime consumer for profile creation or submission.
• No real credential was used. Tests use temporary synthetic fixture strings and remove their files.
• This slice does not scan, associate, project a profile, restart Wi-Fi, change Wi-Fi power, forget a profile, alter a listener/key, reboot, or install an update.
• It does not yet provide the rendered form/controller ownership needed for focus return and cancellation.
• Host tests do not certify physical controls, LCD presentation, real credential entry, association, roaming, or recovery on Mini/Plus/Flip hardware.

Closes no issue; contributes to #544.