[provisioning] Add provisioning window (#17152)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/components/provisioning/test.esp32-idf.yaml

@@ -0,0 +1,25 @@
+# Exercises the provisioning window: api registers as a provisioning source
+# (encryption enabled, no key), the on_timeout automation, and the wifi +
+# esp32_improv cross-component guards. improv_serial is intentionally NOT gated.
+provisioning:
+  timeout: 1min
+  on_timeout:
+    then:
+      - logger.log: "Provisioning window expired"
+
+api:
+  encryption:
+
+wifi:
+  ssid: MySSID
+  password: password1
+
+improv_serial:
+
+binary_sensor:
+  - platform: gpio
+    pin: 0
+    id: io0_button
+
+esp32_improv:
+  authorizer: io0_button

tests/components/provisioning/test.esp8266-ard.yaml

@@ -0,0 +1,16 @@
+# Provisioning window on ESP8266 (no BLE Improv): api as a provisioning source
+# and the wifi reboot guard. improv_serial is present and intentionally NOT gated.
+provisioning:
+  timeout: 1min
+  on_timeout:
+    then:
+      - logger.log: "Provisioning window expired"
+
+api:
+  encryption:
+
+wifi:
+  ssid: MySSID
+  password: password1
+
+improv_serial:

tests/components/provisioning/validate.esp32-idf.yaml

@@ -0,0 +1,15 @@
+# A device provisioned over the network (wifi / Improv) with no api: network
+# connectivity alone satisfies provisioning, so `provisioning:` is valid without an
+# api encryption source. Config-only -- exercises the network provisioning-source
+# validation path (the Improv-only case from the review).
+provisioning:
+  timeout: 1min
+  on_timeout:
+    then:
+      - logger.log: "Provisioning window expired"
+
+wifi:
+  ssid: MySSID
+  password: password1
+
+improv_serial: