scripts: add FW_URI support for regression firmware download

[WuXieSec]

Summary

Add FW_URI support to regression wrappers so testers can provide a direct firmware download URL instead of managing local binary paths manually.

What changed

• added resolve_fw_file helper in scripts/lib/robot.sh
  • accepts either FW_FILE (existing behavior) or FW_URI
  • downloads from FW_URI to cache ($FW_CACHE_DIR or ~/.cache/osfv/firmware)
  • reuses cached file on subsequent runs
  • exports resolved path as FW_FILE
• switched wrappers to use resolver:
  • scripts/regression.sh
  • scripts/regression-rerun-failed.sh
• updated README with FW_URI usage example

Why

This addresses issue #980 goal of reducing manual firmware file handling and improving reproducibility while preserving FW_FILE for local debugging.

Closes #980

[WuXieSec]

Rebased on latest develop and force-pushed to remove BEHIND status.

Updated head commit: 88e2e28b

Could you please re-review when you have a moment? Thanks!

[WuXieSec]

Friendly follow-up on this PR.

It has been rebased on the latest develop branch and is ready for review. Could you please take a look when convenient?

[WuXieSec]

Quick ping on this one. It is rebased, CI is clean, and I am happy to adjust anything if you want the scope trimmed further.

[Rishet11]

Two firmware-cache cases reproduce at 88e2e28bcb160af857e0fa07888662ec2858fae4:

• Different URLs reuse the wrong bytes. In scripts/lib/robot.sh:40-47, /a/firmware.rom and /b/firmware.rom both map to cache/firmware.rom. After downloading A, requesting B returns A without contacting B.
• A failed download becomes a successful cache hit. Curl writes directly to the final path at lines 46-55. A truncated HTTP response produces curl error 18 and leaves a partial file. Retrying the same URL after the server recovers returns that partial file without another request.

Reproduction script, setup and observed output. It executes the unchanged resolver with real /usr/bin/curl and synthetic HTTP responses on 127.0.0.1. Both cases were independently rerun by the orchestrating AI assistant. This is automated resolver validation, not human or device testing.

A URI-based cache key and download-to-temporary-file followed by rename on success would address the two cases. The existing PR remains unchanged.

Could a separate regression-test follow-up be assigned under #980, and would this validation qualify for the bounty program's financial support? Please confirm the scope and support amount before implementation; neither has been agreed.