chore(greptile): iter 1 — applied 4 (3 ACCEPT + 1 MODIFY), rejected 1

Greptile review feedback on PR #21:

ACCEPT:
- test_patch_nimble.py:151 (P1) — replace dead `if False else True`
  ternary with a real assertion that "already applied" is absent on
  the first run.
- test_patch_nimble.py:247 (P1) — invoke the shim subprocess via
  `sys.executable` instead of hardcoded `/usr/bin/python3` so CI's
  setup-python interpreter is used consistently.
- workflows/test.yml:50 (P2) — include hash of
  deps/microReticulum/platformio.ini in PlatformIO cache key so the
  cache invalidates when dependencies change.

MODIFY (narrowed):
- test_ring_buffers.cpp:209 (P2) — keep both `write(data, 0)` and
  `write(data, -1)` assertions, but add a comment clarifying that
  EncodedRingBuffer::write() takes signed `int length` (not size_t),
  so -1 hits the `length <= 0` branch — same as 0. Greptile's
  premise (size_t wrap to SIZE_MAX) does not apply to this codebase.
  The two assertions lock the contract in case the param is ever
  migrated to size_t.

REJECT (silently — no public reply per agent policy):
- test_audio_filters.cpp:237 (P1) — VoiceFilterChain::process()
  takes `numSamples = frames * channels` per the documented
  contract in audio_filters.h:33-40, and the implementation does
  `numFrames = numSamples / channels_` (audio_filters.cpp:63). The
  multichannel test correctly passes `(int)samples.size() = 8000`
  (4000 frames * 2 channels). No out-of-bounds read occurs.

tests/native/test_ring_buffers.cpp

@@ -204,6 +204,9 @@ static void prb_spsc_threaded_stress() {
 static void erb_zero_length_rejected() {
     EncodedRingBuffer eb(4, 64);
     uint8_t data[1] = {0xAA};
+    // EncodedRingBuffer::write() takes `int length` (signed) and rejects
+    // `length <= 0`. Both 0 and -1 hit the same branch — we exercise both
+    // to lock that contract in case the param ever migrates to size_t.
     EXPECT_TRUE(!eb.write(data, 0));
     EXPECT_TRUE(!eb.write(data, -1));
 }