feat: Support Y700 5G (TB324ZC)

[miner7222]

Adds support for the Lenovo Y700 5G (TB324ZC) — Snapdragon 8 Elite Gen 5,
CN-only. No ROW firmware exists and none is expected.

Reports on coolapk that the Y700 5G still loads efisp are what prompted
this. ABL analysis has since confirmed that TB324ZC does load efisp. Some of the
patches did not land, which 5.3.120-mod6 resolves by extending them.

Approach

TB324ZC follows TB323FU (Y700 5th gen) at every existing decision point, and adds
TB322FC's PRC-only restriction — but not TB322FC's rollback-protection exemption,
since TB324ZC is assumed to have rollback protection.

Rather than duplicating a TB324ZC check beside each TB323FU and TB322FC check —
there are roughly thirty of them across the GUI, update handlers and workers, and
missing one would fail silently — the two behaviours became capability
predicates: DeviceClass::uses_efisp_gbl_route() (TB323FU, TB324ZC) and
DeviceClass::is_prc_only() (TB322FC, TB324ZC), plus a fingerprint-side
fingerprint_uses_efisp_gbl_route().

Two details worth calling out:

• The full-flash path deliberately keeps target-firmware identity separate from
  live-device identity — GBL/ARB work follows the firmware fingerprint, while
  the region skip follows fingerprint or device model. Those stayed two
  predicates rather than collapsing into one.
• The EDL-start PRC recheck used to ride on TB322FC's rollback_floors == None
  sentinel. TB324ZC has rollback protection and so always has floors, which means
  it would never have hit that check. It is now keyed on an explicit PRC-only
  predicate, with TB322FC's behaviour preserved exactly.

TB324ZC is not hardware-equivalent to TB323FU, so no fingerprint_model_match
equivalence was added — the two must stay distinguishable, and each has its own
dashboard portrait.

Flashing

Because TB324ZC is PRC-only, modify_region can never be set for it, so the
existing need || modify_region GBL condition already reduces to what is wanted:
the efisp GBL is downloaded and flashed only when a rollback bypass is
required, and the install is otherwise a plain re-sign. No special case was
added for that; it falls out of the PRC-only restriction.

efisp uses the same pinned baldur release and name + SHA-256 allow-list as
TB323FU. That pin moves to
5.3.120-mod6,
which carries the extended patches TB324ZC needs; TB323FU moves with it.

Country code

TB324ZC has proinfo where the other Y700 models have oemowninfo, so it uses
proinfo + persist. Field-only country matching now covers proinfo as well
as persist: proinfo carries build strings such as TB324ZC_PRC, and a blind
scan would be rewritten across every occurrence by replace_in_place.

Unverified assumptions

These cannot be settled from the repository or without hardware, and are the
reason this should not merge yet:

1. That the 5.3.120-mod6 GBL behaves as intended on TB324ZC end to end, and
   that moving TB323FU onto the same tag is safe for it.
2. That proinfo + persist carry the country code in the same field layout the
   sibling Lenovo models use.
3. That TB324ZC's vendor_boot/vbmeta LUNs match TB323FU's — Boot Recovery is
   blocked on that assumption, and root GKI is blocked for the same reason it is
   on TB323FU.

(That TB324ZC loads efisp at all is no longer an assumption — it is confirmed.)

Note on overlap

The proinfo field-only one-liner also exists in #90 (Xiaoxin Pro 13). The two
branches are otherwise independent; whichever lands second resolves a one-line
conflict in country_field_only.

Verification

cargo clippy --workspace --all-targets -- -D warnings is clean and
cargo test --workspace is green (ltbox-core 51, ltbox-device 59, ltbox-gui 226,
ltbox-patch 174, locale guards 3). All coverage is static; nothing here has been
exercised against a device.

Do not merge until verified on real hardware.