feat(ppclock): SUOTA 固件升级（ota.py + CLI ota 子命令 + 预检），APK互证报告入库，123 测试全绿

tests/test_cli.py

@@ -191,3 +191,18 @@ class TestBatch:
         code, out = run_cli(capsys, ["--json", "batch", str(f), "--stop-on-error"])
         results = out["data"]["results"]
         assert len(results) == 1 and results[0]["ok"] is False
+
+
+class TestOta:
+    def test_ota_precheck_without_yes(self, capsys):
+        code, out = run_cli(capsys, ["--json", "ota", "app/firmware-PP_da14585_4.2_CH.img"])
+        assert code == 0
+        assert out["data"]["precheck"] == "ok"
+        assert out["data"]["body_size"] == 72164
+
+    def test_ota_rejects_bad_file(self, capsys, tmp_path):
+        bad = tmp_path / "bad.img"
+        bad.write_bytes(b"\x00" * 128)
+        code, out = run_cli(capsys, ["--json", "ota", str(bad)])
+        assert code == 1
+        assert out["ok"] is False