fix(config-rom): reject suspended generation exports

[gly11]

Summary

• make ConfigROM selector 14 reject suspended cache entries
• preserve explicit suspended-cache access for internal lifecycle callers
• add a regression test for the exact-generation filtered lookup

Problem

ExportConfigROM documents exact-generation lookup with no stale fallback, but
it called the ConfigROMStore overload that returns suspended entries. A bus
reset between a client generation read and selector 14 could therefore return
a complete ROM from the previous generation and let the client reuse stale
node routing information.

Fix

Use FindByNode(generation, node, false) in the user-client handler. The existing
not-cached path then returns empty data for suspended entries, while internal
callers can still opt into suspended cache access.

Verification

• ConfigROMStoreConcurrencyTests: 8 passed
• GitHub Build and Test check: passed
• git diff --check
• no dext build, install, or hardware mutation was required

CI organization

Shared CI workflow cleanup is tracked separately in #88. After #88 merges, this branch should be rebased onto main so the duplicated CI commits can be dropped cleanly.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4b59542c8f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".