fix(pre-bringup): resolve P0 + quick-win P1 findings from 2026-04-19 audit

Addresses findings from docs/DEVELOP_AUDIT_2026-04-19.md:

P0 source-level:
- F-4.3 ADAR1000_Manager::adarSetTxPhase now writes REG_LOAD_WORKING
  with LD_WRK_REGS_LDTX_OVERRIDE (0x02) instead of 0x01. Previous value
  toggled the LDRX latch on a TX-phase write, so host TX phase updates
  never reached the working registers.
- F-6.1 DDC mixer_saturation / filter_overflow / diagnostics were deleted
  at the receiver boundary. Now plumbed to new outputs on
  radar_receiver_final (ddc_overflow_any, ddc_saturation_count) and
  aggregated into gpio_dig5 in radar_system_top. Added mark_debug
  attributes for ILA visibility. Test/debug inputs tied low explicitly.
- F-0.8 adc_clk_mmcm.xdc set_clock_uncertainty: removed invalid -add
  flag (Vivado silently rejected it, applying zero guardband). Now uses
  absolute 0.150 ns which covers 53 ps jitter + ~100 ps PVT margin.

P1:
- F-4.2 adarSetBit / adarResetBit reject broadcast=ON — the RMW sampled
  a single device but wrote to all four, clobbering the other three's
  state.
- F-4.4 initializeSingleDevice returns false and leaves initialized=false
  when scratchpad verification fails; previously marked the device
  initialized anyway so downstream PA enable could drive a dead bus.
- F-6.2 FIR I/Q filter_overflow ports, previously unconnected, now OR'd
  into the module-level filter_overflow output.
- F-6.3 mti_canceller exposes 8-bit saturation counter. Saturation was
  previously invisible and produces spurious Doppler harmonics.

Verification:
- 27/27 iverilog testbenches pass
- 228/228 pytest pass (cross-layer contract + cosim)
- MCU unit tests 51/51 + 24/24 pass
- Remote Vivado 2025.2 build: bitstream writes; 400 MHz mixer pipeline
  now shows WNS -0.109 ns which MATCHES the audit's F-0.9 prediction
  that the design only closed because F-0.8's guardband was silently
  dropped. ft_clkout F-0.9 remains a show-stopper (requires MRCC pin
  move), tracked separately.

Not addressed in this PR (larger scope, follow-up tickets):
F-0.4, F-0.5, F-0.6, F-0.7, F-0.9, F-1.1, F-1.2, F-2.2, F-3.2, F-4.1,
F-4.7, F-6.4, F-6.5.

9_Firmware/9_2_FPGA/constraints/adc_clk_mmcm.xdc

@@ -88,8 +88,9 @@ set_false_path -hold -from [get_ports {adc_d_p[*]}] -to [get_clocks adc_dco_p]
 # Timing margin for 400 MHz critical paths
 # --------------------------------------------------------------------------
 # Extra setup uncertainty forces Vivado to leave margin for temperature/voltage/
-# aging variation. Reduced from 200 ps to 100 ps after NCO→mixer pipeline
-# register fix eliminated the dominant timing bottleneck (WNS went from +0.002ns
-# to comfortable margin). 100 ps still provides ~4% guardband on the 2.5ns period.
-# This is additive to the existing jitter-based uncertainty (~53 ps).
-set_clock_uncertainty -setup -add 0.100 [get_clocks clk_mmcm_out0]
+# aging variation. 150 ps absolute covers the built-in jitter-based value
+# (~53 ps) plus ~100 ps temperature/voltage/aging guardband.
+# NOTE: Vivado's set_clock_uncertainty does NOT accept -add; prior use of
+# -add 0.100 was silently rejected as a CRITICAL WARNING, so no guardband
+# was applied. Use an absolute value. (audit finding F-0.8)
+set_clock_uncertainty -setup 0.150 [get_clocks clk_mmcm_out0]