[mhellevang]

Split of #213 (merge order):

1. Bound SBP-2 max_payload by link speed, log posted-write fault address #214 Standalone fixes (max_payload, posted-write, rcvPhyPkt) ← this PR
2. Read bus-reset generation from SelfIDCount, not reserved 0x06C #215 Bus-reset generation from SelfIDCount
3. SBP-2: re-login/reconnect after rediscovery, not on a 100 ms timer #216 Reconnect after rediscovery
4. SBP-2: carry command data by OHCI physical DMA #217 Physical DMA, needs 2+3
5. SBP-2: bus reset only when a logout with a command outstanding fails #218 Recovery/teardown policy, needs 4
6. SBP-2: DMA HBA task data in place via fBufferIOVMAddr #219 Zero-copy, needs 5

---

Standalone fixes split out of #213.

• max_payload is now bounded by link speed (SBP-2 §5.1.2, Linux sbp2.c:1169-1176): 512 B at S100, doubling per step, capped at 4096 and by our own max_rec. main emitted 4096 at S400. The 512-byte fallback when BusOptions is unreadable is logged.
• Posted-write errors read PostedWriteAddressHi/Lo before the ack (Linux ohci.c:2121-2125), replacing the generic message.
• AsyncSubsystemLifecycle uses LinkControlBits::kRcvPhyPkt (bit 10). The local constant was bit 12, so teardown never cleared rcvPhyPkt.

Host tests: new FetchAgentTests.MaxPayloadRoundsDownAndRespectsLinkSpeed. HW: LS-9000 scan, to be run together with the other two split PRs.

[mhellevang]

HW: LS-9000 full scan clean on a build with this + #215 + #216 (d50b605): 2466 status blocks, no timeout or LUN reset, max_payload now 2048 at S400.