fix(pre-bringup): second-batch P1/P2/P3 audit findings

Addresses the remaining actionable items from
docs/DEVELOP_AUDIT_2026-04-19.md after commit 3f47d1e.

XDC (dead waivers — F-0.4, F-0.5, F-0.6, F-0.7):
- ft_clkout_IBUF CLOCK_DEDICATED_ROUTE now uses hierarchical filter;
  flat net name did not exist post-synth.
- reset_sync_reg[*] false-path rewritten to walk hierarchy and filter
  on CLR/PRE pins.
- adc_clk_mmcm.xdc ft601_clk_in references replaced with foreach-loop
  over real USB clock names, gated on -quiet existence.
- MMCM LOCKED waiver uses REF_PIN_NAME filter instead of the
  previously-missing u_core/ literal path.

CDC (F-1.1, F-1.2, F-1.3):
- Documented the quasi-static-bus stability invariant above the
  FT601 cmd_valid toggle block.
- cdc_adc_to_processing gains an `overrun` output; the two CIC->FIR
  instances feed a sticky cdc_cic_fir_overrun flag surfaced on
  gpio_dig5 so silent sample drops become visible to the MCU.
- Removed the dead mixers_enable synchronizer in ddc_400m.v; the _sync
  output was unused and every caller ties the port to 1'b1.

Diagnostics (F-6.4):
- range_bin_decimator watchdog_timeout plumbed through receiver
  and top-level, OR'd into gpio_dig5.

ADAR (F-4.7):
- delayUs() replaced with DWT cycle counter; self-initialising
  TRCENA/CYCCNTENA, overflow-safe unsigned subtraction.

Regression: tb_cdc_modules.v 57/57 passes under iverilog after
the cdc_modules.v change. Remote Vivado verification in progress.

9_Firmware/9_2_FPGA/ddc_400m.v

@@ -25,7 +25,10 @@ module ddc_400m_enhanced (
     input wire reset_monitors,
     output wire [31:0] debug_sample_count,
     output wire [17:0] debug_internal_i,
-    output wire [17:0] debug_internal_q
+    output wire [17:0] debug_internal_q,
+    // Audit F-1.2: sticky CIC→FIR CDC overrun flag (clk_400m domain). Goes
+    // high on the first dropped sample and stays high until reset_monitors.
+    output wire cdc_cic_fir_overrun
 );
 
 // Parameters for numerical precision
@@ -148,22 +151,20 @@ always @(posedge clk_400m or negedge reset_n) begin
     end
 end
 
-// CDC synchronization for control signals (2-stage synchronizers)
-(* ASYNC_REG = "TRUE" *) reg [1:0] mixers_enable_sync_chain;
+// CDC synchronization for control signals (2-stage synchronizers).
+// Audit F-1.3: the mixers_enable synchronizer was dead — its _sync output
+// was never consumed (the NCO phase_valid uses the raw port), and the only
+// caller (radar_receiver_final.v) ties the port to 1'b1. Removed.
 (* ASYNC_REG = "TRUE" *) reg [1:0] force_saturation_sync_chain;
-wire mixers_enable_sync;
 wire force_saturation_sync;
-assign mixers_enable_sync = mixers_enable_sync_chain[1];
 assign force_saturation_sync = force_saturation_sync_chain[1];
 
 // Sync reset via reset_400m (replicated, max_fanout=50). Was async on
 // reset_n_400m — see "400 MHz RESET DISTRIBUTION" comment above.
 always @(posedge clk_400m) begin
     if (reset_400m) begin
-        mixers_enable_sync_chain <= 2'b00;
         force_saturation_sync_chain <= 2'b00;
     end else begin
-        mixers_enable_sync_chain <= {mixers_enable_sync_chain[0], mixers_enable};
         force_saturation_sync_chain <= {force_saturation_sync_chain[0], force_saturation};
     end
 end
@@ -600,7 +601,10 @@ assign cic_valid = cic_valid_i & cic_valid_q;
 wire fir_in_valid_i, fir_in_valid_q;
 wire fir_valid_i, fir_valid_q;
 wire fir_i_ready, fir_q_ready;
-wire [17:0] fir_d_in_i, fir_d_in_q; 
+wire [17:0] fir_d_in_i, fir_d_in_q;
+// Audit F-1.2: per-lane CIC→FIR CDC overrun pulses (clk_400m domain)
+wire cdc_fir_i_overrun;
+wire cdc_fir_q_overrun;
 
 cdc_adc_to_processing #(
     .WIDTH(18),
@@ -613,7 +617,8 @@ cdc_adc_to_processing #(
     .src_data(cic_i_out),
     .src_valid(cic_valid_i),
     .dst_data(fir_d_in_i),
-    .dst_valid(fir_in_valid_i)
+    .dst_valid(fir_in_valid_i),
+    .overrun(cdc_fir_i_overrun)
 );
 
 cdc_adc_to_processing #(
@@ -627,9 +632,21 @@ cdc_adc_to_processing #(
     .src_data(cic_q_out),
     .src_valid(cic_valid_q),
     .dst_data(fir_d_in_q),
-    .dst_valid(fir_in_valid_q)
+    .dst_valid(fir_in_valid_q),
+    .overrun(cdc_fir_q_overrun)
 );
 
+// Audit F-1.2: sticky-latch the two per-lane overrun pulses in the 400 MHz
+// domain and expose a single module-level flag. Cleared only by
+// reset_monitors (or reset_n via reset_400m), matching the other DDC
+// diagnostic latches (overflow/saturation).
+reg  cdc_cic_fir_overrun_sticky;
+always @(posedge clk_400m) begin
+    if (reset_400m || reset_monitors)                         cdc_cic_fir_overrun_sticky <= 1'b0;
+    else if (cdc_fir_i_overrun || cdc_fir_q_overrun)          cdc_cic_fir_overrun_sticky <= 1'b1;
+end
+assign cdc_cic_fir_overrun = cdc_cic_fir_overrun_sticky;
+
 // ============================================================================
 // FIR Filter Instances
 // ============================================================================