OTA: clean refusal report in ota_push.py; shorter signature error

The device refuses at the header and hangs up mid-transfer; the push
client now says so instead of crashing on the reset. The error fits a
Toast (47 characters).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

lib/ota/src/update_parser.cpp

@@ -30,7 +30,7 @@ void UpdateParser::parseHeader() {
     if (sigLen == 0 || sigLen > update::kMaxSignature) return fail("missing signature");
     uint8_t digest[32];
     Sha256::hash(h, update::kSignedBytes, digest);
-    if (!verifier_.verify(digest, h + 82, sigLen)) return fail("bad signature: not signed with this device's key");
+    if (!verifier_.verify(digest, h + 82, sigLen)) return fail("bad signature (wrong key)");
 
     downgrade_ = versionOlder(version_, installed_);
     if (!sink_.begin(imageSize_)) return fail("could not prepare the update slot");