Bring up the USB gadget link (package 0b, Pi side and talos side)

The Pi presents NCM Ethernet and ACM serial from a configfs gadget, started by
robot-usb-gadget.service before networking. usb0 gets 10.55.0.2/30 with no
gateway through netplan, matched by interface name: a MAC match turns into
PermanentMACAddress= in networkd, which a gadget interface does not have, so it
stayed unmanaged. talos reaches the Pi at 10.55.0.2 (ping ~2.4 ms, SSH works)
through a NetworkManager profile, host/omarchy/robot-usb-link.sh, matched by the
gadget's fixed host MAC.

Also clamp the face's tunable parameters (focus sets a blur radius, persistence
divides) and fps, after a review flagged unvalidated node parameters.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs

pi/install-usb-gadget.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Pi side of the USB link (HANDOFF package 0b). Run as root from this directory. Re-runnable.
+# Needs a reboot afterwards for the dwc2 mode change to take effect.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+install -m 755 usb-gadget.sh /usr/local/sbin/robot-usb-gadget
+install -m 644 robot-usb-gadget.service /etc/systemd/system/robot-usb-gadget.service
+install -m 600 netplan-usb0.yaml /etc/netplan/60-usb0.yaml
+echo libcomposite > /etc/modules-load.d/robot-usb-gadget.conf
+
+cfg=/boot/firmware/config.txt
+[ -e "$cfg.bak-usbgadget" ] || cp "$cfg" "$cfg.bak-usbgadget"
+if grep -qx 'dtoverlay=dwc2' "$cfg"; then
+  sed -i 's/^dtoverlay=dwc2$/dtoverlay=dwc2,dr_mode=peripheral/' "$cfg"
+elif ! grep -qx 'dtoverlay=dwc2,dr_mode=peripheral' "$cfg"; then
+  printf '\n[all]\ndtoverlay=dwc2,dr_mode=peripheral\n' >> "$cfg"
+fi
+
+netplan generate
+systemctl daemon-reload
+systemctl enable robot-usb-gadget.service
+systemctl enable serial-getty@ttyGS0.service
+echo "installed; reboot to apply"