fix(companion): restore the v1.27 -> v1.28 scope migrations

eed6d31d dropped two one-time migrations as "old cruft", but both are needed
by exactly the upgrade path this release ships: v1.27 has sentinel 0xC0DE002A
and the scope list is new in this cycle.

- loadScopeList() again turns an existing single default_scope_name/key into
  list entry 1 (default) and MyMesh::begin() seeds the channels that already
  exist with it. Without it an upgrader's DMs and channels silently go out
  unscoped, contradicting the release note.
- loadPrefsInt() again zeroes repeat_extra_scope_mask/ch_scope_idx when the
  file predates 0xC0DE002B, so the old sentinel tail can't read back as real
  scope picks.

The older-than-v1.27 backfills stay removed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

examples/companion_radio/DataStore.cpp

@@ -622,6 +622,19 @@ void DataStore::loadPrefsInt(const char *filename, NodePrefs& _prefs, double& no
   if (sentinel != NodePrefs::SCHEMA_SENTINEL) {
     MESH_DEBUG_PRINTLN("prefs schema sentinel mismatch: got 0x%08X, expected 0x%08X — re-saving on next change",
                        (unsigned)sentinel, (unsigned)NodePrefs::SCHEMA_SENTINEL);
+    // 0xC0DE002A (v1.27) → 0xC0DE002B: repeat_extra_scope_mask + ch_scope_idx
+    // appended. Unlike the range-clamped fields, these can't be left with whatever
+    // stray bytes rd() picked up from a pre-0x2B file's own sentinel tail:
+    // every bit/byte value is "valid" (any mask or index could be a real pick),
+    // so garbage here isn't caught by a range clamp -- it just silently
+    // masquerades as a real one, and can even reactivate later once the scope
+    // list grows long enough to reach an index that used to be out of range.
+    // Zero both outright on this transition; a fresh scope list is empty
+    // anyway, so there's nothing genuine to lose.
+    if (sentinel < 0xC0DE002B) {
+      _prefs.repeat_extra_scope_mask = 0;
+      memset(_prefs.ch_scope_idx, 0, sizeof(_prefs.ch_scope_idx));
+    }
   }
 
   file.close();
@@ -1037,33 +1050,48 @@ void DataStore::saveChannels(DataStoreHost* host) {
   }
 }
 
-void DataStore::loadScopeList(ScopeList& list) {
+bool DataStore::loadScopeList(ScopeList& list, const NodePrefs& prefs) {
   File file = openRead("/scopes1");
-  if (!file) {
-    // No /scopes1 -- fresh device, stays at the default-constructed ScopeList
-    // (empty, default_idx 0 == "*").
-    list.count = 0;
-    list.default_idx = 0;
-    return;
+  if (file) {
+    uint8_t hdr[2] = { 0, 0 };   // default_idx is read back below even if the header read fails
+    bool success = (file.read(hdr, 2) == 2);
+    uint8_t count = success ? hdr[1] : 0;
+    if (count > ScopeList::MAX_SCOPE_ENTRIES) count = 0;   // corrupt header -- start empty rather than overrun entries[]
+
+    uint8_t loaded = 0;
+    for (uint8_t i = 0; i < count; i++) {
+      ScopeEntry e;
+      bool ok = (file.read((uint8_t *)e.name, sizeof(e.name)) == sizeof(e.name));
+      ok = ok && (file.read(e.key, sizeof(e.key)) == sizeof(e.key));
+      if (!ok) break;   // truncated file -- keep whatever loaded fine so far
+      e.name[sizeof(e.name) - 1] = '\0';
+      list.entries[loaded++] = e;
+    }
+    file.close();
+    list.count = loaded;
+    list.default_idx = list.clamp(hdr[0]);
+    return false;   // the file was already there -- nothing migrated this boot
   }
 
-  uint8_t hdr[2] = { 0, 0 };   // default_idx is read back below even if the header read fails
-  bool success = (file.read(hdr, 2) == 2);
-  uint8_t count = success ? hdr[1] : 0;
-  if (count > ScopeList::MAX_SCOPE_ENTRIES) count = 0;   // corrupt header -- start empty rather than overrun entries[]
-
-  uint8_t loaded = 0;
-  for (uint8_t i = 0; i < count; i++) {
-    ScopeEntry e;
-    bool ok = (file.read((uint8_t *)e.name, sizeof(e.name)) == sizeof(e.name));
-    ok = ok && (file.read(e.key, sizeof(e.key)) == sizeof(e.key));
-    if (!ok) break;   // truncated file -- keep whatever loaded fine so far
-    e.name[sizeof(e.name) - 1] = '\0';
-    list.entries[loaded++] = e;
+  // No /scopes1 yet -- one-time migration of an existing single
+  // default_scope_name/key (Settings > Radio > Scope, pre-list) into list
+  // entry 1 and mark it default, which covers DMs and the relay filter. The
+  // caller finishes the job for channels by seeding their per-channel picks
+  // once channels[] is loaded (see this function's return value). A
+  // never-configured device just stays at the default-constructed ScopeList
+  // (empty, default_idx 0 == "*").
+  list.count = 0;
+  list.default_idx = 0;
+  bool migrated = (prefs.default_scope_name[0] != '\0');
+  if (migrated) {
+    ScopeEntry& e = list.entries[0];
+    StrHelper::strncpy(e.name, prefs.default_scope_name, sizeof(e.name));
+    memcpy(e.key, prefs.default_scope_key, sizeof(e.key));   // already-derived key, no need to re-derive
+    list.count = 1;
+    list.default_idx = 1;
   }
-  file.close();
-  list.count = loaded;
-  list.default_idx = list.clamp(hdr[0]);
+  saveScopeList(list);   // write /scopes1 so this migration runs only once
+  return migrated;       // caller seeds the existing channels with entry 1
 }
 
 void DataStore::saveScopeList(const ScopeList& list) {