Enforce crash-safe build policy

Add compile-time checks for silent reboot, disabled core dumps, and
disabled debugger-aware panic handling. Include regression coverage,
hardening guidance, and update Phase 8/9 project status.

sdkconfig.defaults

@@ -16,7 +16,8 @@ CONFIG_ESP_WIFI_RX_BA_WIN=6
 CONFIG_LWIP_TCP_OOSEQ_MAX_PBUFS=4
 
 # Keep concurrent HTTPS handshakes from exhausting scarce internal DRAM.
-# Active TLS material remains unencrypted in PSRAM until the hardening phase.
+# Active TLS material remains unencrypted in PSRAM; physical extraction is outside
+# the supported threat model (docs/security_hardening.md).
 CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC=y
 # CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC is not set
 # Hardware AES can hang in the PSRAM DMA path and cannot be shared safely with
@@ -72,3 +73,16 @@ CONFIG_ESP_WIFI_SOFTAP_SAE_SUPPORT=y
 
 # Keep diagnostic and interactive-console logging concise but useful.
 CONFIG_LOG_DEFAULT_LEVEL_INFO=y
+
+# Crash memory/registers can contain credentials and serial payloads. Keep the
+# reserved coredump partition unused; enforce resolved settings at compile time.
+CONFIG_ESP_COREDUMP_ENABLE_TO_NONE=y
+# CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH is not set
+# CONFIG_ESP_COREDUMP_ENABLE_TO_UART is not set
+CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT=y
+# CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT is not set
+# CONFIG_ESP_SYSTEM_PANIC_PRINT_REBOOT is not set
+# CONFIG_ESP_SYSTEM_PANIC_GDBSTUB is not set
+# CONFIG_ESP_SYSTEM_GDBSTUB_RUNTIME is not set
+# CONFIG_ESP_DEBUG_OCDAWARE is not set
+# CONFIG_FREERTOS_DEBUG_OCDAWARE is not set