Minimal recut: ordered multi-URL dump input + pass-through

[akhilnarang]

Summary

• Keep the reviewed minimal ordered-URL dumpbot wiring: direct and moderated consecutive URL handling, with single-URL behavior preserved.
• Pin otadump to the published squashed otadump commit for provenance alignment.
• Python 3.14 lock/test flow maintained.

Attempts abandoned

• Large custom Rust/native reimplementation of Zucchini/Puffin/LZ4DIFF.
• AOSP in-process/shared-library extraction exploration/build path (rejected for safety/build complexity).
• Project-replacing pure-Python rewrite.
• Final approach is minimal additive mainline-preserving runtime SHA-pinned Lineage backend (otadump) plus minimal ordered-URL wiring here.

Validation

• Base reviewed local tree 79f13cee9da9ca99fef44ebfb64e6e22ad577e86 reproduced, then updated only pyproject.toml and uv.lock pin from 16f01ce... to 5622cb7a449926a2a3e1c07776b52c3b43120376.
• uv lock --check --python 3.14 passes.
• Focused tests pass: uv run --python 3.14 pytest -q tests/test_firmware_extractor.py.
• Full tests pass: uv run --python 3.14 pytest -q.

Limitations

• Depends on runtime-downloaded otadump backend artifacts (not bundled).
• Incremental extraction capability is limited to Linux x86 scope inherited from the pinned backend.