Honour the GC's ring geometry (BP / RHBP) instead of hardcoding it

Compat TODO item 2, the last silent-corruption risk.  RXFrameAssembler took
the RX ring as a compile-time constant (pages 1-15), so a driver configuring a
SMALLER ring was ignored and we kept writing pages it would never read, with
nothing reporting an error.  The bounds now come from bp/rhbp, wired in BBATop
from the GC's BP (0x0A/0B) and RHBP (0x1A/1B) registers, and both the page wrap
and the free-space calculation use them.

Garbage is rejected rather than obeyed: the driver's values are used only when
bp >= 1 (page 0 is the TX buffer), rhbp <= 0x0F and rhbp > bp.  Otherwise the
hardcoded layout stands and geom_honoured goes low, so a mismatch is
observable.  Without that check BP=0 or an RHBP below BP gives a zero or
negative ring size and the assembler writes outside it.

⚠️ Recorded as a known limitation: a ring must be LARGER than
_MAX_FRAME_PAGES (6) or nothing is ever stored, because a frame's length is
unknown until EOF so the worst case (1518+4 = 6 pages) is reserved up front.
Found the honest way -- the test was written with RHBP=4 first and passed
VACUOUSLY, storing nothing at all.  Making that work needs a length-aware
reservation, which is a bigger change than this one.

T7 (8-page ring honoured, frames only in pages 1-8, and at least one actually
stored) and T7b (all three garbage cases rejected, fallback still stores).
Mutation-tested: wrapping at the hardcoded page 15 writes pages 9-11 and fails
T7; removing the sanity check fails all four T7b assertions.

Item 1 (RX filtering) remains the only open gap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

exi_bba/bba_top.py

@@ -195,6 +195,13 @@ class BBATop(Elaboratable):
             # pointer to know what it must not overwrite, and reports a
             # dropped frame back as RBFI (IR[7]).
             asm.rrp.eq(reg.rrp),
+            # The GC's own ring geometry (BP / RHBP).  Previously hardcoded in
+            # the assembler, so a driver configuring a smaller RX ring was
+            # ignored and we kept writing pages it would never read.  The
+            # assembler sanity-checks these and falls back to pages 1-15 if
+            # they are unusable -- see docs/bba_compat_todo.md item 2.
+            asm.bp  .eq(reg.bp),
+            asm.rhbp.eq(reg.rhbp),
             asm.ncra_rst.eq(reg.ncra_rst_o),
             reg.rx_overflow.eq(asm.rx_overflow),
             self.int_n   .eq(reg.exi_int_n),