Adds store_on_rom() helper (tmpfs $TMPDIR + squashfs/ubifs/overlay
$BINDIR). On such devices core_webget no longer downloads the upx core
(its stub decompresses into a memfd = RAM at runtime); it fetches the
tar.gz instead and core_check stores the naked binary as
$BINDIR/CrashCore.raw, symlinked from $TMPDIR. The binary is
transparently compressed on rom and file-backed/reclaimable at runtime
(RssShmem 0). Other filesystems and explicit upx keep prior behavior.
Also corrects the upx branch symlink target $TMPDIR -> $BINDIR (same
dangling-symlink issue as #1295).
For #1304
On OpenWrt $TMPDIR is tmpfs (RAM) and $BINDIR sits on a
transparently-compressed fs (squashfs/ubifs). Unpacking the core to
$TMPDIR pins the whole ~40MB binary in unreclaimable Shmem, and a
compressed copy is still kept on rom - paying twice.
When $TMPDIR is tmpfs and $BINDIR is squashfs/ubifs/overlay, store the
verified naked binary as $BINDIR/CrashCore.raw and symlink
$TMPDIR/CrashCore to it, dropping the downloaded archive. The binary is
transparently compressed on rom (~2.2:1, comparable to keeping .gz) and
its text/rodata become file-backed and reclaimable at runtime
(RssShmem 0). Other filesystems keep the existing behavior.
The upx branch's symlink target is also corrected from $TMPDIR to
$BINDIR (same dangling-symlink issue as #1295).
For #1304
