Standalone `wifi_tls` binary: station assoc, SNTP, then a validated HTTPS GET to api.github.com against the esp-idf cert bundle. Gates Spike 7 (gitoxide push). Creds come from firmware/.env via build.rs.
