feat(mii): store-and-forward TX path on a single packet FIFO + HW-validated deadlock fixes

[lcapossio]

Summary

Reworks the MII transmit path onto a store-and-forward, single packet FIFO
(mii_tx_saf), replacing the old cut-through mii_if TX. The framer only starts
a frame once the whole frame is committed to the FIFO, so it can never underrun
and the AXIS input may bubble (deassert tvalid mid-frame) with no wire error.

Along the way this adds the on-hardware debug path used to root-cause two TX
deadlocks on an Arty A7-100T, fixes both, and reclaims the now-dead mii_if TX
FIFO BRAM. gmii_cdc (RGMII path) is likewise unified onto an EOF-sideband
packet FIFO with the separate length FIFO removed.

What's included

New RTL

• rtl/mii_tx_saf.v — store-and-forward MII TX core: one async frame FIFO
  ({tlast,data}) + media-clock framer (preamble / SFD / CRC-32 / pad / FCS /
  IFG). Gray-coded committed-frame counter gates frame start → no underrun,
  tolerates AXIS bubbles.
• rtl/axil_arb2.v — 2:1 AXI-Lite arbiter for the JTAG debug path.
• gmii_cdc — unified TX on an EOF-sideband packet FIFO; dropped the length
  FIFO.

Bug fixes (both found and reproduced on hardware)

1. Committed-frame counter wrap (d79d1d0). A 4-bit counter aliased to a
   false "equal" once 16 frames backed up in the 4 KB FIFO, parking the framer
   in idle. Fixed by widening it to FIFO_ADDR_WIDTH+1 bits. Regression
   tb_mii_tx_saf_burst_stall.
2. Oversized / uncommitted-frame wedge (e6d8a95). The write side committed
   only on tlast with no bound on the uncommitted run. A no-tlast run
   reaching the FIFO depth (an oversized frame, or frames merged by a dropped
   tlast upstream) filled the FIFO with uncommitted data: frame_pending never
   rose, the framer parked in idle, wr_full stuck, and the whole TX path
   deadlocked permanently. Fixed by capping the in-flight run at MAX_FRAME
   (force a synthetic EOF, drop the runaway tail) — since MAX_FRAME < FIFO
   depth, a permanent wedge is now structurally impossible. Regression
   tb_mii_tx_saf_oversize.

Debug infrastructure (dc1b307)

• IP_ADDR CSR (0x40) — demo L3 IPv4 made AXI-writable (retarget the board's
  IP over JTAG without a rebuild).
• SAF_DBG CSR (0x94, RO) — mirrors the mii_tx_saf framer/FIFO state into
  the sys domain (committed/drained frame counts, rd_empty, framer state) for
  on-hardware diagnosis. This is what pinned down bug verify: cocotb datapath suite + 13 RTL fixes across gmii_cdc / eth_mac_rx / mii_tx_saf #2.
• EJTAG-AXI bridge + axil_arb2 — CSR access over JTAG (USER4) alongside the
  ELA/EIO.

Resource cleanup (67b71d1)

• mii_if gains a TX_ENABLE parameter (default 1). The MII branch in
  eth_mac_sys sets TX_ENABLE=0 (there mii_tx_saf drives the pins), so the
  dead mii_if TX FIFO is no longer instantiated. Block RAM 6.5 → 5.5 tiles;
  the TX path now has exactly one physical FIFO.

Testing

• Simulation: full regression green — 40 test groups, iverilog -Wall and
  Verilator lint clean. New TBs: tb_mii_tx_saf, tb_mii_tx_saf_burst_stall,
  tb_mii_tx_saf_oversize, tb_axil_arb2.
• Hardware (Arty A7-100T, 10/100 MII):
  • ARP + ICMP + UDP-stats replies verified; ELA-confirmed TX pin waveform.
  • The 64-byte UDP echo flood that previously wedged the board at 300 Mbps
    (echo loss ~99%, TX frozen) now sustains 300–400 Mbps at <1% loss, with
    SAF_DBG returning to clean idle after every burst and RX_ERR=0.
  • Timing met, WNS +0.360 ns.

Scope / notes

• Default TX_ENABLE=1 keeps the legacy eth_mac.v wrapper and all MII TX
  testbenches unchanged.
• No functional change to the RGMII datapath's external behavior; its TX FIFO was
  unified internally.
• Docs updated: docs/registers.md (new CSRs), docs/missing_features.md
  (Known Issues → resolved), README.md, fpga/arty_a7/README.md, CHANGELOG.md.