Add CommandStation metadata contract for EX-Installer

[BanjoR]

Summary

This is a CommandStation-EX metadata contract change for EX-Installer host discovery. It adds a backward-compatible, side-effect-free query that returns the established product/device/release information frame, centralizes the existing startup and responses, and documents the field contract.

References

• Related context only: CommandStation issue #415 reports an EX-Installer antivirus classification; this metadata contract does not claim to resolve that security-tool behavior.
• Superseded PRs: none identified during the live duplicate audit.
• No installer source is included; the EX-Installer consumer remains a separate sibling contribution.

Scope and exclusions

• CommandStation metadata response and its tests/documentation only.
• Personal integration code and unrelated protocol behavior are explicitly out of scope.

Validation evidence

• tools/metadata_contract_test.py passed with the bundled Python runtime.
• git diff --check against upstream/master passed.
• Clean task-owned checkout and exact five-file allowlist verified.
• Exact-head fork CI: PASS - CI run 31946738885 completed successfully for head b0f5b4f.
• The upstream firmware workflow is push-triggered, so no pull-request firmware check is attached; the exact-head fork run above is the available hosted build evidence.
• PASS - Exact default python -m platformio run in a clean task checkout with an isolated PlatformIO core completed for all five configured environments: mega2560, ESP32, Nucleo-F411RE, Nucleo-F446RE, and Nucleo-F429ZI.

Hardware validation

Hardware validation: Not run—no hardware available.

Maintainer bench criteria: query and on a supported CommandStation, verify stable field ordering and values, then run the EX-Installer discovery flow against the returned metadata without changing existing clients.

This PR is ready for maintainer review; CI validation remains outstanding.