Live ADT tunables for USB4 on the J516M #10

Part of #1

Question

Which USB4 tunables does iBoot actually add to the live ADT on this J516M, and with what values?

J516M device tree against Apple's ADT for USB4 found that the firmware ADT has none of the tunables iBoot adds at boot. The tunable names come from m1n1's copy tables, not from observed values. The names to confirm:

• pcie_adapter_regs_tunables (per ACIO);
• atc-apcie-{rc,fabric,debug}-tunables and apcie-config-tunables (per tunnel root port);
• the oe-fabric and tunnel-DART tunables that the J516S hard-codes.

Task:

1. Read the live ADT the bootloader handed over, read-only, the way the Aurora --m3-report collector does: load phram on the ADT region, read it, then unload.
2. Extract only the USB4 nodes' tunable properties.
3. Record which exist and their sizes, and keep the values on the research branch.

Publish no per-unit calibration or identifiers.