Define fan/airflow proof semantics and heater authorization sequence

[danielbrownjr]

Follow-up from PR #1 interlock review. This is important safety architecture work, but it is not a Phase-0 merge blocker.

Problem

The current abstract interlock denies heat and latches JJ_FAULT_FAN whenever fan_proven == false.

That is fail-cold, but the physical meaning of "fan proven" and the sequencing that produces that proof have not yet been frozen.

Potential proof mechanisms include tach/RPM threshold, airflow sensing, current sensing, command acknowledgement, or a combination. The final design may also require an explicit sequence such as:

fan command -> spin-up interval -> proof -> heater permission

Decision required

Define the product-level contract for:

• what constitutes valid fan/airflow proof;
• when proof must exist relative to heater authorization;
• spin-up/grace timing, if any;
• transient loss of proof while heating;
• fault latch and recovery behavior;
• what remains valid when one fan fails, if the design has multiple fans;
• what HIL/bench evidence is required before heating capability is released.

Acceptance criteria

• Fan/airflow proof semantics are documented against the release-intent hardware.
• Heater authorization sequencing is explicit and auditable.
• The interlock contract is updated if necessary.
• Host tests cover the chosen state transitions.
• HIL/bench verification requirements are added to the safety evidence plan.
• No heater actuator path may bypass this prerequisite once heater support is implemented.

Related: PR #1.

[danielbrownjr]

Phase-0 model update from PR #1 corrective safety review (commits 8459894 and 9097b27): the interlock now distinguishes fan proof as unavailable, pending, proven, or explicitly failed. Unavailable/pending proof blocks heat without latching a fan fault and requests 100% fan output; only explicit failure (or an invalid proof state) latches JJ_FAULT_FAN. This establishes the auditable fan-command -> proof-pending -> proven/failed shape without inventing a timeout, RPM, tach, airflow, or current threshold. Those release-intent hardware semantics and HIL/bench evidence remain unresolved, so this issue stays open and remains a Phase-2/3 prerequisite before heater actuation.