Ship the reader wheels inside the package for offline install

A device with no internet could not set itself up: the auto-install needed
PyPI. The rdm6300 and pyserial wheels now ship inside the package, so first
start works with no network at all.

Both wheels are pure Python (py3-none-any / py2.py3-none-any), which is what
makes this possible - the same files work on armv7l, aarch64 and x86_64. This
is the difference from the workstation app's Files/repository cache, which
held aarch64 manylinux binaries and so could not be committed; that cache only
ever existed on the Pi devices.

- bundled_wheel_dir() locates them; ensure_dependencies() prefers them
  automatically, so the service needs no --wheel-dir.
- verify_wheels() checks SHA256SUMS before installing. A wheel that fails its
  checksum is refused rather than installed, then PyPI is tried, and if that is
  unreachable it reports exit 2 instead of proceeding unverified.
- local_wheel_missing() falls back to PyPI when the bundle does not cover a
  requirement, instead of attempting a --no-index install that must fail.
- An explicit --wheel-dir that is incomplete or unverified is called out, not
  silently swapped for PyPI.

Verified end to end: built wheel and sdist both contain the wheels; a venv
with no rdm6300 self-provisions with a dead proxy and no PIP_NO_INDEX; and a
tampered wheel is refused with nothing installed.

deploy/rdm-card-reader.service

@@ -21,7 +21,8 @@ WorkingDirectory=/opt/rdm-card-reader
 # --port points at the udev alias, so the reader is the same device every boot.
 # Autodetect refuses to guess if more than one USB adapter is present, which is
 # the safe behaviour: a wrong guess means authenticating the wrong person.
-# Add --wheel-dir /opt/rdm-card-reader/wheels to install dependencies offline.
+# The wheels for rdm6300 and pyserial are bundled inside the package, so no
+# --wheel-dir is needed here: the install works with no internet.
 ExecStart=/opt/rdm-card-reader/.venv/bin/rdm-card-reader \
     --serve \
     --port /dev/rdm-reader \