feat: add serial port listing and CLI flags

Implement cel_serial_list_ports/cel_serial_free_ports with
platform backends: Windows reads HKLM\HARDWARE\DEVICEMAP\
SERIALCOMM (fast, single registry read), POSIX scans /dev for
ttyUSB*/ttyACM*.

telemetry tool gains --list, --port, and --baudrate flags;
baud rate was previously hardcoded to 400000. Rename the
tool_telemetry CMake target to telemetry.

Fix test_free_ports_zero_count, which passed a stack array to
cel_serial_free_ports (which calls free() on it), corrupting
the heap.

celrs/CMakeLists.txt

@@ -5,6 +5,12 @@ target_compile_features(celrs_crsf PRIVATE c_std_23)
 add_library(celrs_serial STATIC serial.c)
 target_include_directories(celrs_serial PUBLIC "${CMAKE_SOURCE_DIR}")
 target_compile_features(celrs_serial PRIVATE c_std_23)
+if (IS_WINDOWS)
+    target_sources(celrs_serial PRIVATE platform/serial_win.c)
+    target_link_libraries(celrs_serial PRIVATE advapi32)
+elseif(IS_LINUX OR IS_MACOS)
+    target_sources(celrs_serial PRIVATE platform/serial_posix.c)
+endif()
 
 # Level-filtering logger — calls log_write(); symbol resolved by the final binary
 add_library(celrs_logger STATIC logger.c)

celrs/platform/serial_internal.h

@@ -0,0 +1,7 @@
+#pragma once
+#include <stddef.h>
+
+/* Platform-specific port enumeration.
+ * Returns the number of ports found, or -1 on error.
+ * out_ports must be freed with cel_serial_free_ports(). */
+int cel_serial_platform_list_ports(char*** out_ports, int max_ports);

celrs/platform/serial_posix.c

@@ -0,0 +1,36 @@
+#include "celrs/platform/serial_internal.h"
+
+#include <dirent.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+int cel_serial_platform_list_ports(char*** out_ports, int max_ports) {
+    char** ports = (char**)calloc(max_ports, sizeof(char*));
+    if (ports == NULL) return -1;
+
+    int count = 0;
+    DIR* dir = opendir("/dev");
+    if (dir != NULL) {
+        struct dirent* entry;
+        while ((entry = readdir(dir)) != NULL && count < max_ports) {
+            if (strncmp(entry->d_name, "tty", 3) == 0) {
+                char* rest = entry->d_name + 3;
+                if (strncmp(rest, "USB", 3) == 0 ||
+                    strncmp(rest, "ACM", 3) == 0) {
+                    char path[256];
+                    snprintf(path, sizeof(path), "/dev/%s", entry->d_name);
+
+                    if (access(path, R_OK | W_OK) == 0) {
+                        ports[count] = strdup(path);
+                        if (ports[count] != NULL) count++;
+                    }
+                }
+            }
+        }
+        closedir(dir);
+    }
+
+    *out_ports = ports;
+    return count;
+}

celrs/platform/serial_win.c

@@ -0,0 +1,41 @@
+#include "celrs/platform/serial_internal.h"
+
+#include <windows.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Enumerate active COM ports via HKLM\HARDWARE\DEVICEMAP\SERIALCOMM.
+ * Windows keeps one value per active port in this key, so this is a
+ * single registry read instead of probing COM1..COM255 with CreateFile. */
+int cel_serial_platform_list_ports(char*** out_ports, int max_ports) {
+    char** ports = (char**)calloc(max_ports, sizeof(char*));
+    if (ports == NULL) return -1;
+
+    int count = 0;
+
+    HKEY key;
+    if (RegOpenKeyExA(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\SERIALCOMM",
+                      0, KEY_READ, &key) == ERROR_SUCCESS) {
+        for (DWORD index = 0; count < max_ports; index++) {
+            char value_name[256];
+            char port_name[256];
+            DWORD value_name_len = sizeof(value_name);
+            DWORD port_name_len  = sizeof(port_name);
+            DWORD type;
+
+            LONG result = RegEnumValueA(key, index, value_name, &value_name_len,
+                                         NULL, &type, (BYTE*)port_name, &port_name_len);
+            if (result != ERROR_SUCCESS) break;
+
+            if (type == REG_SZ) {
+                ports[count] = _strdup(port_name);
+                if (ports[count] != NULL) count++;
+            }
+        }
+
+        RegCloseKey(key);
+    }
+
+    *out_ports = ports;
+    return count;
+}

celrs/serial.c

@@ -3,16 +3,7 @@
 #endif
 
 #include "celrs/serial.h"
-
-/*
- * Platform-agnostic serial port implementation.
- *
- * Windows uses Win32 CreateFile/ReadFile/WriteFile.
- * POSIX uses open/read/write with termios.
- *
- * This is a stub implementation that compiles but does nothing.
- * Real platform-specific code will be added when TDD tests drive it.
- */
+#include "celrs/platform/serial_internal.h"
 
 #include <stdlib.h>
 #include <string.h>
@@ -67,3 +58,17 @@ void cel_serial_flush(cel_serial_port* port) {
     (void)port;
     /* TODO: platform-specific flush */
 }
+
+int cel_serial_list_ports(char*** out_ports, int max_ports) {
+    if (out_ports == NULL) return -1;
+    if (max_ports <= 0) max_ports = 64;
+    return cel_serial_platform_list_ports(out_ports, max_ports);
+}
+
+void cel_serial_free_ports(char** ports, int count) {
+    if (ports == NULL) return;
+    for (int i = 0; i < count; i++) {
+        free(ports[i]);
+    }
+    free(ports);
+}

celrs/serial.h

@@ -22,3 +22,11 @@ size_t cel_serial_write(cel_serial_port* port, unsigned char const* buf, size_t
 
 /* Flush output buffer */
 void cel_serial_flush(cel_serial_port* port);
+
+/* List available serial ports.
+ * Returns the number of ports found, or -1 on error.
+ * Caller must free the returned array with cel_serial_free_ports(). */
+int cel_serial_list_ports(char*** out_ports, int max_ports);
+
+/* Free the port list returned by cel_serial_list_ports */
+void cel_serial_free_ports(char** ports, int count);