[Pre-release] TRV setpoint tracking

Pre-release / beta: This build is for testing and feedback. It is not a stable release, and behavior may change before the stable release.

This pre-release adds improved tracking of setpoint changes made directly on TRVs managed by an over_climate thermostat. A changed setpoint is applied to VTherm only after it remains stable for five seconds.

An accepted setpoint becomes a manual request. If VTherm is OFF, the request is saved without turning the thermostat on or clearing a forced OFF.

Tracking treats values equal or too close to the last command sent to a TRV as ambiguous. Delayed echoes can still be mistaken for manual changes, and some genuine changes may be ignored. Tracking-induced physical commands are limited to three attempts per VTherm before tracking is suspended; direct VTherm control remains available.

Please treat this as a beta feature and report results with your TRV model and any unexpected behavior, especially delayed echoes or reactive automations.

What's Changed

• Add a security policy (SECURITY.md) by @jasonjhofmann in #2142

Full Changelog: 10.6.2...10.6.3.beta1