feat(console): restyle the node console to the new design

[Bugs5382]

What and why

Restyles the node's text console (internal/console) to the Node Console design: the frame with the wordmark and a coloured tag, the new ASCII mark, one 15-column label column centred as a 54-wide block, the design's wording, and the 16-colour palette with bold as bright. It covers boot and a failed boot step, maintenance, awaiting ceremony, awaiting parent certificate, ceremony in progress, the serving dashboard for Root, Intermediate and Issuing at 80x25 and 64x24, degraded, the reset confirmation, a new mismatch screen and resetting, plus the 38x11 compact view. The renderer stays hand-rolled ANSI with no new dependency.

It also fixes the footer, which printed vv0.1.0: version() added a "v" to a git-describe version that already has one.

Closes #343

Behaviour beyond layout:

• A wrong CN on the reset confirmation now shows "Does not match. Nothing was erased." for 5 seconds, then returns to the dashboard (Esc or Ctrl-C returns at once). Before, it went straight back with no message.
• The reset screens show the version in the footer, so RenderResetConfirm and RenderResetting take it, and the boot banner prints CryptOS PKI <version>.
• "not enrolled" and TPM "UNAVAILABLE" are plain, not yellow: both are normal states.
• The intermediate's label is "Intermediate" so it fits the label column.
• On a console too short for the mark, the mark is dropped before any status line.
• A CA name too long for the compact dashboard is cut with ASCII ... at the console edge instead of wrapping past it; a long CN on the reset confirmation is split over rows instead of being clipped, because the operator has to retype it.
• The degraded screen (before the first snapshot, or after a failed one) now shows the console's build version instead of v? in the footer, matching every other screen.

Screens that need state the node does not report yet (Root Mode, upgrade in progress, a framed post-boot failure, safe to power off, live boot and ceremony step progress, the key tier, the retry count) are left for later.

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• Rebased on main after the TSA work (feat(tsa): issue and rotate the TSA certificate and key #351 to fix(tsa): keep stamping through a grace window after the last good sync #357); no conflict.
• gofmt -l, go vet ./..., golangci-lint run ./... and go test ./... all clean locally.
• TestScreensMatchTheDesign compares 35 golden frames in internal/console/testdata/screens/ (text, and a per-character colour mask) for every state at 80x25 and 64x24, the boot stream, and the compact views. The framed goldens are the design's own grids.
• TestFramedScreensFillTheConsole checks every screen fills 80x25, 64x24, 100x37 and 40x12 exactly. TestLongValuesWrapInTheValueColumn checks a long CN wraps. TestFooterVersion pins the footer to v0.1.0.
• TestMismatchSaysNothingWasErasedThenReturns covers the mismatch screen in the console loop.
• TestEveryStateRendersAtTheGateSizes: every state at 80x24, 100x37 and 38x11 fills the console, names its state in text with colour stripped, shows v0.1.0 once, and reads differently from every other state. TestBootStepsSayTheirState pins the [ok]/[!!] markers and the banner version.
• Four new compact goldens: awaiting parent, ceremony in progress, serving Intermediate and Issuing at 38x11.
• TestCompactCANameStopsAtTheConsoleEdge and TestResetShowsTheWholeCN: a long CA name is cut with ... on the compact dashboard, and the reset screen splits the CN over rows instead of clipping it.
• TestWithVersionFillsAMissingVersion, TestRenderDegradedShowsTheVersion: the degraded screen showed v?; it now shows the console's build version.

Existing tests changed on purpose, because the wording or layout they check changed:

• TestBannerHasWordmark (now TestBannerHasMarkAndVersion) and TestRendererBanner: the mark replaces the shield and the banner carries the version.
• TestRendererStep: step lines start at column 0.
• TestRenderResetConfirmContent: the new version argument and the typed sample text.
• TestRenderDashboardIssuer: the "Intermediate" label.
• TestRenderCompactShowsTheManagementFingerprint, TestRenderCompactMaintenanceShowsAddressAndFingerprint, TestRenderCompactAwaitingCeremonyShowsTheFingerprint, TestRenderCompactPendingIdentityScreens: the compact view labels the fingerprint "SHA" and the address "IP".
• screenCases' compact list gains four cases (awaiting parent, ceremony in progress, serving Intermediate, serving Issuing); none of the existing cases changed.

The docs site pages that quote console output (boot-qemu, boot-maintenance, reboot-ceremony) will need a matching update.