Phase 8A (1/2): de-Span the serial layer, swap JSON to Newtonsoft

Prepares RioJoy.Core for the net40 (Windows XP) target, which has no
System.Memory, ValueTask, or System.Text.Json:
- IRioTransport and the whole protocol/framing layer now use byte[] +
  Task (RioPacket.Payload, PacketParser/Builder, RioChecksum, replies,
  AnalogReport, RioHidReport). At 9600 baud Span bought nothing; the
  SerialPortTransport bridge copies disappear entirely.
- ConfigStore/OverlayTemplateStore switch to Newtonsoft 13 with the
  same conventions (indented, PascalCase, string enums, null-skipping);
  verified against the real STJ-written config.json and regions.json
  (load + round-trip). System.Memory and System.Text.Json packages
  dropped.

275 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/RioSerialMonitor/Program.cs

@@ -68,7 +68,7 @@ bool Changed(AnalogReport a, AnalogReport b) =>
 link.PacketReceived += p =>
 {
     packets++;
-    ReadOnlySpan<byte> pl = p.Payload.Span;
+    byte[] pl = p.Payload;
     switch (p.Command)
     {
         case RioCommand.ButtonPressed when pl[0] < RioAddress.ButtonCount: