fix(vd960DBN): loop_data 改用 iot_mqtt_publish 发送, 缓冲隔离防 _raw 异常 v3

- root cause (v3): event_report 的 mqtt_publish → MQTTSerialize_publish(mqttBuf)
  写入的 MQTT 二进制泄漏到 loop_data 的 payload 缓冲, 产生 _raw 异常

- fix: loop_data 改用 iot_mqtt_publish() 发送, 其内部 buf[1024] 与
  全局 mqttBuf[1024] 物理隔离, event_report 和 loop_data 不再争用同一缓冲

- 同时: 消灭 data_json[1024] (v1), coil_count 硬限 (v1),
  msg_id 改预读避免 iot_mqtt_publish 内部 ++ 导致跳号

- note: iot_send_heartbeat 有同样 msg_id 双 ++ 问题, 待修

vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/iot_mqtt_srv.c

@@ -686,9 +686,9 @@ void iot_mqtt_publish_sensor(void) {
     }
 
     /*--- Step 4: 构建 JSON → 发布 (字段与 V1.02 协议一致) ---
-       直接构建到 payload, 省掉 data_json[1024] 中间缓冲:
-       - 消除 BSS 压力 (省 1024B), 降低与 mqttBuf 重叠风险
-       - 消除 %s 拷贝尾部二进制残留的路径 (2026-07-23 _raw 事故)
+       直接构建到 payload, 省掉 data_json[1024]:
+       - 用 iot_mqtt_publish() 代替 mqtt_publish(), 发送缓冲隔离
+         (event_report→mqttBuf vs loop_data→iot_mqtt_publish::buf[1024])
        - coil_count 边界硬限, 防 0xC0 坏帧致溢出                        */
     static char payload[1400];
     char *p = payload;
@@ -697,12 +697,13 @@ void iot_mqtt_publish_sensor(void) {
     const char *freq_level_names[] = {"high", "mid_high", "mid_low", "low"};
     uint8_t i;
     uint8_t coil_n = _cached_sr.coil_count;
+    uint32_t my_msg_id = g_iot_msg_id + 1;  /* iot_mqtt_publish 内部 ++g_iot_msg_id, 这里只预读 */
     if (coil_n > 4) coil_n = 4;  /* 硬限: 防坏帧致 snprintf 循环溢出 */
 
     /* 先写外层包装头 (msg_id/cmd/ts/data) */
     written = snprintf(p, remaining,
-        "{\"msg_id\":%d,\"cmd\":\"loop_data\",\"ts\":%lu,\"data\":{\"channels\":[",
-        ++g_iot_msg_id, dev_time_now());
+        "{\"msg_id\":%lu,\"cmd\":\"loop_data\",\"ts\":%lu,\"data\":{\"channels\":[",
+        (unsigned long)my_msg_id, dev_time_now());
     if (written < 0 || written >= remaining) return;
     p += written; remaining -= written;
 
@@ -735,10 +736,12 @@ void iot_mqtt_publish_sensor(void) {
 
     snprintf(p, remaining, "]}}");
 
+    /* 用 iot_mqtt_publish: 发送缓冲 buf[1024] 与 mqttBuf[1024] 物理隔离,
+       避免 event_report 的 MQTT 二进制污染 loop_data 载荷 (2026-07-23 _raw 事故 v3) */
     {
         char topic[IOT_MQTT_TOPIC_MAX_LEN];
         snprintf(topic, sizeof(topic), "dld960/%s/dev", g_iot_dev_serial);
-        mqtt_publish(topic, payload, 0);
+        iot_mqtt_publish(topic, payload, strlen(payload), 0);
     }
 }