fix: shrink E2E header so protected payloads fit a LIN frame; validate publish length

[SoundMatt]

Problem

The documented ASIL-B E2E-protected publish pattern (SAFETY_MANUAL.md
§4.2: Protector::protect() output fed into Bus::publish() /
slave::Node::set_response()) was unimplementable as written: the E2E
header (kHeaderSize = 10) alone already exceeded kLINMaxDataLen (8),
so every protected payload — even an empty one — exceeded the LIN
frame's data limit. Nothing on the publish path checked data.size()
against kLINMaxDataLen either, so an oversized payload was silently
accepted and stored as a "valid" response.

Fix

1. Shrink the E2E wire format from a 10-byte header (DataID,
   SourceID, SequenceCounter, CRC-16, all transmitted) to a 3-byte
   header (1-byte SequenceCounter, wraps mod 256, + CRC-16). DataID and
   SourceID are no longer transmitted — both ends of an E2E link
   already share an identical Config out of band, and DataID/SourceID
   remain bound into the CRC computation, so a receiver configured with
   a mismatched identity still gets a CRC error rather than silently
   accepting a message meant for a different logical data element. This
   leaves room for up to kLINMaxDataLen - kHeaderSize = 5 bytes of
   protected payload in a single LIN frame, instead of none.

2. Validate publish length. virt::Bus::do_publish() (the sole
   concrete publish path, used by Bus::publish/publish_classic and
   transitively by slave::Node::set_response()) now rejects
   data.size() > kLINMaxDataLen with ErrInvalidFrame instead of
   silently accepting and storing it. Empty data remains a valid
   "clear response" signal, unaffected by this check.

SAFETY_MANUAL.md §4.2's example is updated to state the real payload
budget and check bus->publish()'s returned error.

Requirement titles/descriptions for REQ-SAFETY-001/002/003/004/005/ 006/007/010/012 are updated in both requirements/requirements.json
and .fusa-reqs.json to match the new wire format; IDs are unchanged
per this repo's traceability convention.

Testing

• Rewrote tests/test_safety.cpp for the new 3-byte header layout;
  added regression tests for: header fits within kLINMaxDataLen,
  counter wraparound mod 256, and DataID/SourceID mismatch surfacing as
  a CRC error even though they're no longer transmitted.
• Added regression tests in tests/test_virtual.cpp and
  tests/test_slave.cpp confirming oversized publish()/
  set_response() calls are rejected and not stored.
• Full build + ctest (176/176 passing).
• ASan+UBSan build + ctest (176/176 passing).

Closes #17