ci: add interrupted-OTA swap-move canary

[neilberkman]

MCUboot has had real interrupted-OTA regressions in swap-using-move and revert handling where a power cut during upgrade leaves the device bricked or booting the wrong image. This PR adds a post-merge canary for that failure class on main so new regressions in that path are caught earlier in CI.

The canary is implemented with tardigrade, a Renode-based fault-injection harness for OTA boot paths. In one representative swap-using-move configuration on nrf52840dk_nrf52840, it builds MCUboot, builds and signs two hello_world images, injects power-loss faults across the upgrade path, and fails if any fault point bricks the device or leaves it on the wrong image.

What this workflow does:

• builds MCUboot main in one representative swap-move configuration
• builds two signed hello_world images with MCUboot's RSA-2048 test key so the image format matches the bootloader configuration
• runs on main when relevant OTA files change, weekly on a schedule, and manually via workflow_dispatch
• pins a stable Zephyr release tag so the signal stays about MCUboot rather than unrelated Zephyr main churn
• pins the tardigrade action by full commit SHA

Scope:

• intended to catch swap-move resume and revert regressions in the #2100 / #2199 class
• does not cover swap-scratch (#2109), different-sized images, alternate validation policies, or other swap modes
• tardigrade can exercise those configurations locally, but this PR intentionally wires in one representative swap-move canary first

About the external action:

• the tardigrade action is a stateless composite action
• it downloads the caller-provided Renode tarball, installs Python dependencies, runs the local audit CLI, and uploads the resulting JSON report
• there is no external service, backend, or telemetry path beyond the tool downloads already visible in the workflow