[Junior Martinez (jmartinez-silabs)]

Cherry-pick from main

Issue Link:
N/A

Description of Problem/Feature:

Factory/manufacturing data provisioning was bundled into a single SLC path: reader backends always pulled write-path pieces (storage writer, custom storage hooks, BLE channel, iostream/RTT) and linked proprietary provision libraries even when the app only needed to read credentials at runtime. That forced manufacturing write support and related deps into normal product builds, and the components still pointed at the pre-rework provision layout/headers/libs.

Description of Fix/Solution:

Split provisioning into a read-only backend plus an optional manufacturing write channel, aligned with the reworked provision stack in matter_sdk / matter_support:

• matter_provision_default / matter_provision_flash are Factory Data Readers only (NVM3/token vs dedicated flash), with sources/includes updated to the reader + crypto paths.

• New optional matter_provision_channel (Factory Data Writer Channel) adds the storage writer, custom storage hooks, and BLE transport, and defines SL_MATTER_PROVISION_CHANNEL_ENABLED. It requires matter_provision and selects the matching writer for default or flash.

• Dropped hard iostream / iostream_rtt requirements from the reader components.

• Simplified proprietary lib linking to ABI-keyed archives (libProvision-m33-hard*, libProvision-m4-softfp*); default links them only when the channel is enabled, flash keeps them for the flash backend.

• Bumped third_party/matter_sdk and third_party/matter_support to the matching provision rework commits.

Sibling PRs:
SiliconLabsSoftware/matter_sdk#1268
SiliconLabsSoftware/matter_support#272
https://github.com/SiliconLabsSoftware/matter_provisioning/pull/456

Testing Done:

• Provision BRD4187C, BRD4116A, BRD4407A BRD4338A with using their new GFW. Flash the their lighting-app and commission using the provisioned discriminator and certificates.
• Full smoke and regression CI will be needed to find possible corner case

[cursor]

PR Summary

Medium Risk
Large CI/workflow and submodule pointer changes affect all builds and artifact publishing; firmware-facing risk is mostly from new SQA build variants and timing configs rather than application logic in this diff.

Overview
This PR aligns the extension with Matter 2.10.0 / SiSDK 2026.12 (.gitmodules, matter.slce, matter_app.slsdk, README doc links) and expands GitHub Actions around faster, package-aware builds.

SDK caching replaces per-job submodule+LFS checkout with a shared cache-sdks composite action (tarball restore/save keyed by submodule SHAs), wired into builder, code-size, OTA, and dev-apps workflows plus a Seed SDK cache workflow that prunes stale SDK caches.

Conan package CI adds actions to export/cache matter / matter_app, reusable builder-pkg / platform-builder-pkg / dev-apps-builder-pkg flows, Create Matter Packages dispatch, and a package-based OTA size checker—so downstream jobs can build from matter_app via restored Conan home instead of full tree builds.

Zephyr gains a matrix job for all-devices-app (multiple boards, OTA variants), standardized dev-artifacts-zephyr-* layout, and a merge/packaging stage; Jenkins can upload Zephyr artifacts to UBAI.

Build matrices (silabs-builds-*.json) refresh ICD/SIT variants (sit-60, lit-120 + transport idle), add boards (e.g. brd9084b, brd4343c/s), drop brd4408a, and add SiWx PSRAM SQA variants. SQA tools add mmic_host (CPC build) on the classic path; the package path fetches WiFi NWP firmware via Conan instead of wifi_sdk.

Other CI polish: Thursday-only SQA app gating on release_*, extra sanity-test token refresh, gitmodules branch validation, bot author on auto-PRs, and Jenkins helpers (UBAI timeouts, SQA upload/regression scheduling).

^{Reviewed by Cursor Bugbot for commit fe1cb8f. Configure here.}

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. For privacy information, see our Privacy Notice. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: example@example.com

or

I have read the CLA Document and I hereby sign the CLA behalf of my company, e-mail: example@example.com

Signature is valid for 6 months.

---

5 out of 10 committers have signed the CLA.
✅ (Sarthak-Shaha)[https://github.com/Sarthak-Shaha]
✅ (jmartinez-silabs)[https://github.com/jmartinez-silabs]
✅ (korino-silabs)[https://github.com/korino-silabs]
✅ (jepenven-silabs)[https://github.com/jepenven-silabs]
✅ (miduggan24)[https://github.com/miduggan24]
❌ sabollim-silabs
❌ chirag-silabs
❌ Matthew Albert (@malbert-silabs)
❌ stefan-silabs
❌ Rohan Sahay (@rosahay-silabs)
_{This bot will be retriggered when the Contributor License Agreement comment has been provided. Posted by the CLA Assistant Lite bot.}