Record the on-air verification and how to run the bench beacon

Both firmware fixes are now confirmed over the air, with the sniffer board
capturing and asn1tools judging the result.

GN lifetime: our station transmits 0x05 (1 s), the value both bench stations
use, where the August captures show 0x83 (3200 s) for the same frames. 397 CAMs
from station 999999 decode and re-encode byte-identically, so the whole
transmit chain is right on the wire, not only in the host tests.

yawRateConfidence: the bench beacon, flashed to a spare board, sends CAMs that
decode and re-encode byte-identically as well (72 of 72 from station
0x0BADC0DE). NOTES.md now says how to flash that beacon and how to check what
it sends, including that it shares the phone pinger's MAC and the two are told
apart by station ID.

The new firmware also runs on the OBU with the phone attached: CAM, DENM and
SPATEM from the bench stations all keep decoding in the app now that messages
are cut to the length their header declares.

Signed reception stays open. The CiT One transmits unsigned and nothing else
here signs, so it needs real roadside traffic, the CiT One switched to signed
mode, or a replay firmware on a spare board.

Two bench facts worth not rediscovering are recorded too: opening COM3's
console resets the OBU and drops the phone's USB link, and every capture taken
before today is truncated at its first corrupted record, because the receiver's
console inserts a CR before every 0x0a byte of the binary pcap stream.
live_capture.py now undoes that, a change that lives in the receiver repo and
is not part of this commit.

obu-cam-transmistter/NOTES.md

@@ -51,3 +51,49 @@ Known gaps, tracked as TODOs in the source: no real GNSS (lat/long hardcoded
 0), no real time source (detectionTime/referenceTime hardcoded 0, decodes as
 2004-01-01), fixed (non-rotating) pseudonym MAC, SHB instead of GeoBroadcast
 (no multi-hop forwarding), unsecured (no IEEE 1609.2 signing).
+
+## Running it as a bench beacon
+
+This firmware needs no phone: it beacons a CAM every second by itself
+(`TX_INTERVAL_MS`) from station `0x0BADC0DE` (195936478), stationType 5
+(passengerCar), at the hardcoded bench position, under the fixed MAC
+`02:00:00:00:00:01`, on 5900 MHz. That makes it the quickest way to put known,
+repeatable traffic on air, and it is how the 4-bit `yawRateConfidence` encoding
+was confirmed over the air on 2026-09-14.
+
+A board with only one USB-C port is fine. This firmware's console is on UART0,
+so such a board shows no log output, but nothing here needs the console.
+
+Flash it from the toolchain terminal (ESP-IDF 5.5.4, see the table above):
+
+```powershell
+cd C:\Users\Ashin\AndroidStudioProjects\MicrOBU\obu-cam-transmistter
+idf.py -p COM10 -b 921600 flash
+```
+
+Or flash the existing build without any toolchain terminal:
+
+```powershell
+cd obu-cam-transmistter\build
+C:\Espressif\python_env\idf5.5_py3.11_env\Scripts\python.exe -m esptool --chip esp32c5 -p COM10 -b 921600 write_flash --flash_mode dio --flash_freq 80m --flash_size 2MB 0x2000 bootloader/bootloader.bin 0x8000 partition_table/partition-table.bin 0x10000 obu_firmware.bin
+```
+
+It starts beaconing as soon as it boots, so there is nothing to start by hand,
+and unplugging it is how you stop it.
+
+**It transmits under the same MAC as the phone's CAM pinger**, so on air the two
+are told apart by station ID (195936478 here, 999999 for the pinger), never by
+source address.
+
+To see what it is sending, capture on the sniffer board and decode:
+
+```powershell
+cd its-g5-receiver-firmware
+py -3.11 live_capture.py COM8
+py -3.11 ..\obu-firmware\test\pcap_gn_tally.py recordings\capture_<timestamp>.pcap
+```
+
+The tally lists it as SHB / port 2001 / lifetime `0x05`. For the message itself,
+decode the payload with `asn1tools` against `asn1/cam_1_4_1.asn` +
+`asn1/cdd_1_3_1_1.asn`; re-encoding must return the identical bytes. On
+2026-09-14, 72 of 72 frames did.