Minesweeper: verify its logic on the host, and document it in both languages

apps/minesweeper/host_test.c includes the app source with a fake app_api_t, so the real state machine runs on a PC: every string it draws is recorded and the lit pixels are counted. Measured -- a reveal/flag/new-game/digit/quit script returns normally, draws the title, the mine count and lights 24 pixels; a script that blindly reveals 85 cells reaches a terminal state eleven times, draws BOOM, and MENU starts a new game after it (terminal at record 356, title again at 4180). The win path is the one branch blind play does not reach.

Both READMEs now say what is verified (compiles clean under gcc -Wall -Wextra -Werror against upstream's real app_api.h, which is what caught the API's true member names and the absence of left/right keys; the logic runs on the host) and what is not (never built for ARM, never run on the radio -- no toolchain and no Docker here).

apps/minesweeper/README.md

@@ -44,3 +44,18 @@ that `APP_KEY_LEFT`/`APP_KEY_RIGHT` do not exist).
 Not verified: it has never been built for ARM or run on the radio, because no
 `arm-none-eabi-gcc` and no Docker exist on the machine it was written on. Treat the
 first build and the first run as the real review.
+
+## The host harness (how far verification got)
+
+`host_test.c` includes the app source and hands it a fake `app_api_t`, so the real state
+machine runs on the PC -- every string it draws is recorded and the lit pixels are counted:
+
+    gcc -std=gnu11 -O1 -Wall -Wextra -Werror -I.. -o host_test host_test.c && ./host_test
+
+Measured: a reveal/flag/new-game/digit/quit script returns normally, draws the title and the
+mine count, and lights pixels; a script that blindly reveals 85 cells reaches a terminal state
+eleven times, draws `BOOM`, and MENU starts a new game afterwards. The win path (`CLEAR`) was
+not reached by blind play, so it is the one branch this harness does not exercise.
+
+Still unverified: never built for ARM, never run on the radio -- no `arm-none-eabi-gcc` and no
+Docker where it was written. The first build and the first run are the real review.