pull out bug fixes from ha_app branch

[Lash-L]

No description provided.

[Copilot]

Pull request overview

This PR pulls in several bug fixes and behavioral adjustments across protocol auth (Hawk), onboarding/runtime state, MQTT TLS proxy authorization, and routine execution—primarily to make local behavior match observed Roborock app/device behavior more closely.

Changes:

• Update Hawk auth to MAC/sign JSON requests based on the raw JSON body bytes (and thread raw_body through request handling).
• Add onboarding support to provisionally accept unknown device MQTT credentials only during an active onboarding session (matching IP + known public key), then persist them after confirming the first publish topic.
• Improve routine execution robustness by adding retries for “action locked” step-start failures and requiring a stable non-cleaning state before declaring a step complete; extend scene listing payloads with edit context.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_runtime_state.py	Adds coverage for onboarding MQTT candidate gating (IP + key presence).
tests/test_routine_runner.py	Adds coverage for action-locked retries, dock settle timeout, and stable completion confirmation.
tests/test_mqtt_tls_proxy.py	Adds coverage for onboarding-only CONNECT authorization and credential persistence on first publish.
tests/test_admin_api.py	Updates Hawk helper to sign canonical JSON bodies and adds scene edit-context/create tests.
tests/contracts/test_ios_app_init_contract.py	Sends canonical JSON bytes and signs Hawk using json_body.
src/roborock_local_server/server.py	Passes raw_body into Hawk verification.
src/roborock_local_server/bundled_backend/shared/runtime_state.py	Introduces onboarding_device_mqtt_candidate() logic for onboarding credential gating.
src/roborock_local_server/bundled_backend/shared/runtime_credentials.py	Adds confirm_device_mqtt_credentials() to persist learned device MQTT creds safely.
src/roborock_local_server/bundled_backend/shared/routine_runner.py	Adds action-locked retry path, stable completion confirmation, and parameterized dock-settle delay.
src/roborock_local_server/bundled_backend/shared/protocol_auth.py	Hashes raw JSON body bytes for Hawk MAC when present; supports raw_body in verification.
src/roborock_local_server/bundled_backend/mqtt_tls_proxy_server/server.py	Adds provisional onboarding auth + confirmation on first publish topic; tracks conn endpoints.
src/roborock_local_server/bundled_backend/https_server/routes/user/scene/service.py	Includes home_id and device context in per-device scene listing payloads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.