fix(companion): channel save/lookup hardening + trail count guard

Address the open items from the FEATURES.md audit backlog:
- saveChannels() now skips unused slots (all-zero secret) instead of
  writing all 40 every time, so /channels2 holds only configured channels
  (was always ~2.7 KB) and wears the flash less. loadChannels() already
  compacted empties on read, so the loaded result is unchanged.
- findChannelIdx() returns -1 for an all-zero secret, so a corrupted/empty
  channel can't match an unused all-zero slot and misroute messages.
- TrailStore gains a static_assert that CAPACITY fits the uint16_t save
  header count, failing the build instead of silently truncating.

Also re-classify two audit items verified to be non-issues in current
code: the bot strstr "199-char" truncation (BOT_SCRATCH=200 >= MAX_TEXT_LEN
=160, unreachable) and the MSG_PICK reply title (rlen clamped to 20, so
title[24] never overflows).

Verified: WioTrackerL1_companion_solo_dual builds clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

examples/companion_radio/Trail.h

@@ -25,6 +25,9 @@ static const uint8_t TRAIL_FLAG_SEG_START = 0x01;
 class TrailStore {
 public:
   static const int CAPACITY = 512;
+  // _count is serialised as uint16_t in the save header — fail the build loudly
+  // if CAPACITY is ever grown past what that can hold, rather than truncating.
+  static_assert(CAPACITY <= 0xFFFF, "TrailStore::CAPACITY must fit in the uint16_t save-header count");
 
   // Fixed sampling cadence — matches the sensor manager's default GPS update
   // rate (1 s). Density is controlled by the min-delta gate (settings) rather