feat: reliable Bluetooth pairing, reconnection, and A2DP setup

Four fixes, each a root cause verified on hardware (AX211 + Bose QC Ultra):

1. Link Key Request Reply TRUNCATED: the pending-command queue's params
   buffer was 16 bytes; the reply is 22 (addr 6 + key 16).  The controller
   got 10 key bytes -> every stored-key reconnection failed authentication
   (status 5) since 2026-06-03 (c119a70).  Fresh pairings never touch this
   path, which kept the bug perfectly disguised as a headset quirk.

2. Secure Connections host support (0x0C7A) now enabled: bonds are minted
   as P-256 (Type=7), interoperable with BlueZ's, and SC-bonded peers can
   actually authenticate us.

3. Never write the BD_ADDR override (0xFC31) with the factory address:
   it desyncs the firmware's crypto address from the on-air one and ALL
   SSP pairing fails with status 5.  (The spoofing feature itself was
   already known-cosmetic: the baseband answers pages on the factory
   address regardless.)  import-bluez-bond.sh now removes the override.

4. A2DP channel setup: wait for Encryption Change before dialing L2CAP
   (post-SSP sinks ignore unencrypted CONN_REQ), and LISTEN 2.5s first --
   on reconnection the sink dials AVDTP itself and ignores our dials while
   doing so.  Ends the historical connRsp=FFFF retry-then-give-up failures.

Plus: queued security replies now log delivery + controller status.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/import-bluez-bond.sh

@@ -83,14 +83,13 @@ with open(path, "wb") as f:
 print(f"wrote {path} ({len(blob)} bytes, 1 bond)")
 EOF
 
-# Pin the configured MAC to the factory address (truthful display; the 0xFC31
-# override is cosmetic on this hardware anyway).
+# Remove any BD_ADDR override: the controller must run its factory address
+# with NO 0xFC31 write.  Verified on the AX211: writing 0xFC31 -- even with
+# the factory address itself -- desyncs the address the firmware uses in SSP
+# crypto from the one on air, and every pairing fails with status 5.
 CONF="$TARGET/config/bluetooth.toml"
-mkdir -p "$TARGET/config"
 if [ -f "$CONF" ] && grep -q '^ *mac *=' "$CONF"; then
-    sed -i "s/^ *mac *=.*/mac = \"$ADAPTER\"/" "$CONF"
-else
-    printf 'mac = "%s"\n' "$ADAPTER" >> "$CONF"
+    sed -i '/^ *mac *=/d' "$CONF"
+    echo "removed mac override from $CONF (0xFC31 breaks SSP on AX211)"
 fi
-echo "set $CONF mac = $ADAPTER"
 echo "done — boot MontaukOS; the device should reconnect without re-pairing."