Upgrade ESP32 Arduino to 3.3.12 and NimBLE-Arduino to 2.5.1

[antomanc]

The firmware still pins ESP32 Arduino 3.3.10 and NimBLE-Arduino 2.5.0. Update CI and README to the stable 3.3.12 / 2.5.1 patches, add a host regression harness to CI, and document software coverage and the remaining physical checks in tests/VALIDATION.md.

Reviewed ESP32 3.3.11, 3.3.12, and the NimBLE 2.5.1 release and source comparison. The scan/client/server callbacks, subscription/write APIs, broadcast notifications and per-handle indications used here remain compatible; no production firmware changes are needed.

NimBLE's scan-response timer fix covers host reinitialization. TrainerBridge initializes NimBLE once and reconnects by restarting scans and reusing its client; this PR does not assume the upstream crash affects this project.

Validation

• GitHub Actions run: PASS, including host regressions and the real firmware compile with no compiler warnings. CI flash: 628,084 bytes (47%); static RAM: 37,172 bytes (11%).
• Exact CI command passed locally with no warnings: arduino-cli compile --warnings all --fqbn esp32:esp32:esp32 TrainerBridge, using the real pinned dependencies and Arduino CLI 1.5.2-rc.1.
• Flash: 627,988 / 1,310,720 bytes (47%); static RAM: 37,172 / 327,680 bytes (11%).
• bash tests/run.sh: PASS. Executes the actual sketch and helpers with boundary doubles: module self-checks, scan retry timing, 20 simulated disconnect/reconnect cycles, failed connection/subscription, two-client telemetry routing and advertising, FTMS success/failure/timeout/late-response handling and originating-client indication routing.
• AddressSanitizer + UndefinedBehaviorSanitizer: PASS with leak detection disabled because LeakSanitizer cannot inspect processes in this environment.
• git diff --check: PASS.

Limits and follow-up

Hardware tests have not run. The harness does not execute NimBLE/FreeRTOS internals or validate radio delivery, scan-response timer lifetime, concurrency or physical leaks. The validation notes include an ESP32/D100/Garmin/app checklist for repeated reconnects, simultaneous subscriptions, and real ERG/simulation/control recovery.

Existing FTMS behavior is unchanged and explicitly documented: cross-client opcode coalescing retains the latest handle; trainer disconnect clears pending transactions without immediately failing them; initial Request Control is attempted before the connection flag permits the write; trainer response opcodes are not matched against the pending opcode. These protocol concerns require separate work rather than being hidden in a compatibility update.

Dedicated patch upgrade PR; no merge performed.