Load the trustlet and configure it

On the phone, end to end from the daemon:

    lookupTA('focal64') -> result=23 (nothing to unload)
    trustlet loaded from /lib/firmware/focal64.mbn, distName='fingerprint'
    config /lib/firmware/fingerprintd.json: 349 bytes
      CMD 0x100d -> result=0 rc=0 (Success)
      CMD 0x2005 -> result=0 rc=0 (Success)

The config is the one fp6fpcfg.py --daemon generates, so the reduction of nine
hand-edited ffcfg files to one generator is confirmed against the trustlet
rather than only against the files it replaced.

A stale instance is unloaded before loading, which is what stops a crashed
experiment costing a reboot; result=23 is the clean-slate answer.

The request envelope moves into Fingerprintd:Ta with the rest of the layouts:
command id at +0, declared length at +4, payload at +0x10, and on the way back
the trustlet's own rc at +8 and the capture metric at +0x0c. Both are HEADER
fields ahead of the payload -- the metric has been miscalled "payload+12" in
this project's notes, and every recorded finger number depends on reading it
where it actually is.

ENUMERATE answering rc=0 is correct here and not a regression: no group is
active and no storage listeners are registered yet, so there are no templates
to count.

tests/Ta/main.cpp

@@ -203,6 +203,38 @@ int main() {
               "reading at the payload offset directly gives the wrong word");
     }
 
+    // ---- The request/response envelope
+    {
+        std::vector<std::byte> req(256);
+        std::array<std::byte, 4> payload{ std::byte{1}, std::byte{2},
+                                          std::byte{3}, std::byte{4} };
+        BuildRequest(req, Cmd::SyncConfig, payload);
+        Check(Get32(req, ReqCmdOff) == 0x100d, "command id at +0");
+        Check(Get32(req, ReqLenOff) == 4, "declared length at +4");
+        Check(std::to_integer<unsigned>(req[ReqPayloadOff]) == 1, "payload at +0x10");
+        Check(ReqPayloadOff == ResponsePayloadOff, "request and response payloads share the offset");
+
+        // An empty payload leaves the declared length zero rather than
+        // pointing at uninitialised bytes.
+        BuildRequest(req, Cmd::Enumerate, {});
+        Check(Get32(req, ReqLenOff) == 0, "no payload, no declared length");
+        Check(Get32(req, ReqCmdOff) == 0x2005, "ENUMERATE");
+
+        // rc and the metric are HEADER fields, ahead of the payload, and are
+        // distinct from each other.
+        std::vector<std::byte> out(256);
+        auto put = [&](std::size_t off, std::uint32_t v) {
+            for (std::size_t i = 0; i < 4; i++)
+                out[off + i] = static_cast<std::byte>((v >> (8 * i)) & 0xFF);
+        };
+        put(RespRcOff, static_cast<std::uint32_t>(-11));
+        put(RespMetricOff, 345);
+        Check(ResultCode(out) == -11, "rc at +8, signed");
+        Check(CaptureMetric(out) == 345, "metric at +0x0c");
+        Check(RespRcOff != RespMetricOff && RespMetricOff < ResponsePayloadOff,
+              "both sit in the header, ahead of the payload");
+    }
+
     // ---- Poisoning
     {
         std::vector<std::byte> payload(64);