fix(security): close OOB read in path-decoding callers (BLE + LoRa-anon)

Both mesh::Packet::writePath and ::copyPath did a raw memcpy of the
decoded hash_count*hash_size bytes from src to dest with no bound on
src. Two call sites used phone-supplied or LoRa-anon-supplied buffers
where the path_len byte was attacker-controlled:

  - CompanionMesh CMD_SEND_CHANNEL_DATA accepted len>=4 and called
    writePath with no src bound; a paired phone could leak up to ~65
    bytes of syswq stack into the outgoing LoRa channel-data frame.

  - RepeaterMesh handleAnonRegionsReq / handleAnonOwnerReq /
    handleAnonClockReq read reply_path_len from an unauthenticated
    LoRa anon-request payload and called copyPath without any src
    bound. Any LoRa neighbor could leak repeater stack into the
    reply path.

Hardened the API: both functions now require an explicit src_len
and reject (return 0) when the decoded byte count exceeds it.
Updated all 14 call sites across Packet/Mesh/Dispatcher/BaseChatMesh/
CompanionMesh/RepeaterMesh. Trusted callers (internal MAX_PATH_SIZE
buffers) pass MAX_PATH_SIZE; untrusted callers pass real remaining
length. Added len-5 plumbing through the anon-handler signatures.

CMD_SEND_CHANNEL_DATA also gained a local len>=5 + path_bytes
sanity check for early rejection.

zephcore/include/mesh/Packet.h

@@ -68,8 +68,17 @@ public:
 	void setPathHashCount(uint8_t n) { path_len &= ~0x3F; path_len |= n; }
 	void setPathHashSizeAndCount(uint8_t sz, uint8_t n) { path_len = ((sz - 1) << 6) | (n & 0x3F); }
 
-	static uint8_t copyPath(uint8_t *dest, const uint8_t *src, uint8_t path_len);
-	static size_t writePath(uint8_t *dest, const uint8_t *src, uint8_t path_len);
+	/* writePath / copyPath decode the 6-bit hash_count + 2-bit hash_size
+	 * encoding in path_len, then copy hash_count*hash_size bytes from src
+	 * to dest. src_len bounds the source: if the decoded byte count would
+	 * read past src_len, the call returns 0 (no copy).
+	 *
+	 * Trusted callers writing from internal MAX_PATH_SIZE buffers must
+	 * pass MAX_PATH_SIZE. Callers handling untrusted input (BLE phone
+	 * frames, LoRa anon-request payloads) must pass the real remaining
+	 * length so a malformed path_len cannot trigger an OOB read. */
+	static size_t writePath(uint8_t *dest, const uint8_t *src, size_t src_len, uint8_t path_len);
+	static uint8_t copyPath(uint8_t *dest, const uint8_t *src, size_t src_len, uint8_t path_len);
 	static bool isValidPathLen(uint8_t path_len);
 
 	void markDoNotRetransmit() { header = 0xFF; }