chore(greptile): iter 1 — applied 4 (3 ACCEPT + 1 MODIFY), rejected 1

Greptile review feedback on PR #21:

ACCEPT:
- test_patch_nimble.py:151 (P1) — replace dead `if False else True`
  ternary with a real assertion that "already applied" is absent on
  the first run.
- test_patch_nimble.py:247 (P1) — invoke the shim subprocess via
  `sys.executable` instead of hardcoded `/usr/bin/python3` so CI's
  setup-python interpreter is used consistently.
- workflows/test.yml:50 (P2) — include hash of
  deps/microReticulum/platformio.ini in PlatformIO cache key so the
  cache invalidates when dependencies change.

MODIFY (narrowed):
- test_ring_buffers.cpp:209 (P2) — keep both `write(data, 0)` and
  `write(data, -1)` assertions, but add a comment clarifying that
  EncodedRingBuffer::write() takes signed `int length` (not size_t),
  so -1 hits the `length <= 0` branch — same as 0. Greptile's
  premise (size_t wrap to SIZE_MAX) does not apply to this codebase.
  The two assertions lock the contract in case the param is ever
  migrated to size_t.

REJECT (silently — no public reply per agent policy):
- test_audio_filters.cpp:237 (P1) — VoiceFilterChain::process()
  takes `numSamples = frames * channels` per the documented
  contract in audio_filters.h:33-40, and the implementation does
  `numFrames = numSamples / channels_` (audio_filters.cpp:63). The
  multichannel test correctly passes `(int)samples.size() = 8000`
  (4000 frames * 2 channels). No out-of-bounds read occurs.

tests/build_scripts/test_patch_nimble.py

@@ -15,6 +15,7 @@ What we verify:
 import io
 import os
 import subprocess
+import sys
 from contextlib import redirect_stdout
 from pathlib import Path
 
@@ -148,7 +149,12 @@ def test_pristine_source_applies_all_patches(fresh_tree, patches):
         assert p["label"] in stdout, (
             f"patch {p['label']!r} did not run\n--- stdout ---\n{stdout}"
         )
-        assert f"already applied" not in stdout.split(p["label"])[0].splitlines()[-1] if False else True
+        # On first run, the patch's label line must not say "already applied".
+        label_line = stdout.split(p["label"])[1].split("\n")[0]
+        assert "already applied" not in label_line, (
+            f"first run of {p['label']!r} should not report already-applied\n"
+            f"--- stdout ---\n{stdout}"
+        )
         # File should now contain `new` and not `old`
         content = Path(p["filepath"]).read_text()
         assert p["new"] in content, f"new content missing from {p['filepath']}"
@@ -239,8 +245,10 @@ def test_script_is_executable_via_python(tmp_path):
         f"builtins.env = _Env()\n"
         f"exec(open({str(PATCH_SCRIPT)!r}).read())\n"
     )
+    # Use the same interpreter that runs the test suite (sys.executable),
+    # not /usr/bin/python3 — under setup-python on CI the two diverge.
     result = subprocess.run(
-        ["/usr/bin/python3", str(shim)],
+        [sys.executable, str(shim)],
         capture_output=True,
         text=True,
         timeout=10,