rewrite(phase3): port mdio from c-RCP, revert an earlier session's own regression

[SoundMatt]

Part of the v3.0.0 ground-up rewrite (#129, ROADMAP.md Phase 17), branch rewrite/v3-from-c-rcp. First of Phase 3 Wave 2's three batches (alongside phase3/spi-uart and phase3/pwm-wakeup, separate PRs).

c-RCP's largest single endpoint source file (ep_mdio.c, 1195 lines) — mdio.hpp needed the largest single content expansion of any Phase 3 batch (309 → 1354 lines).

Content deltas vs. prior cpp-RCP state

• Reverted a prior session's own regression (issue [cpp-RCP-03] MDIO endpoint uses an invented Clause 22/45 PHY-address model instead of the spec's addressing scheme #72's 'addressing fix'): that fix discarded the real Clause-22/Clause-45 (MMD) addressing model — 5-bit prtad, plus regad directly or devad+16-bit regad — in favor of an invented opaque mdio_address field, on the mistaken theory that Clause 22/45 had no TC18 basis. c-RCP's ep_mdio.h/.c (rcp_ep_mdio_addr_t, rcp_ep_mdio_addr_valid(), rcp_ep_mdio_burst_next_regad()) keeps this addressing as real, load-bearing content — restored as MdioAddr/addr_valid()/burst_next_regad() (REQ-MDIO-001/002).
• No ACF-level wire codec existed at all — ported the complete read/write request/response pair for both the MMD family and the entirely separate MMS family (REQ-MDIO-012-019/025-028).
• The MMS (Memory Map Selector) addressing family was entirely missing — added MdioMmsAddr, mms_addr_valid()/mms_uses_32bit_words()/mms_burst_next_addr()/mms_mode_for_word_count(), plus 32-bit word packing (REQ-MDIO-022/024).
• REQ-MDIO-024 (external-spec ambiguity) carried forward faithfully: TC18 itself never specifies mdio_address's bit layout for MMS mode (spec-defects item 55, still open in c-RCP); c-RCP closed it with a documented, externally-sourced assumption (OPEN Alliance 10BASE-T1x MAC-PHY Serial Interface Spec V1.1's 4-bit MMS selector + 16-bit ADDR) — carried forward as MdioMmsAddr{mms, addr}, kept characterized as PARTIAL not IMPLEMENTED, matching c-RCP's own .fusa-reqs.json status.
• Table 59 functional-config register block was entirely missing — added, correctly with no base_clk row (unlike every other endpoint type — Table 59 genuinely defines none) (REQ-MDIO-009/010/020/023).
• Removed an invented TriggerRegistry/MdioSignal::TransferComplete — c-RCP's own file header states MDIO has no trigger-signal table at all, mirroring can.hpp's CanEndpoint (no TriggerRegistry either).

Fixed-capacity: EpFuncBlock is std::array<uint8_t, 6> (narrower than sibling endpoints, since MDIO has no base_clk row).

test_mdio.cpp: 12 → 121 TEST_CASEs (420 assertions).

Call sites

None touched — MdioRequest/MdioResponse/MdioEndpoint's transact/handle_request/last_request kept fully source-compatible, so mock.hpp's dispatch_mdio() and its own MDIO tests compile and pass unmodified.

Verification

Full tree rebuilds clean (223/223 targets), 56/56 ctest suites pass (100%) — independently re-verified from a fresh build in the worktree, not just the porting agent's own report.