Enable in-container USB flashing + flash-re-bba-rb skill; find U7 EEPROM undersized

Devcontainer now grants libusb access to the FT2232H so iceprog (bitstream) and
pyftdi (FT2232H EEPROM) run inside the container:
- devcontainer.json: --privileged + /dev/bus/usb bind mount
- Dockerfile: sudo (NOPASSWD for vscode; USB nodes are root-owned), libusb-1.0-0,
  libftdi1-2, pyftdi

Add the flash-re-bba-rb skill documenting the procedure (bitstream via best swept
seed, optional EEPROM string, troubleshooting, guardrails) and
flash_ftdi_eeprom.py (pyftdi, backup-first, dry-run default) + ftdi_eeprom.conf
value spec.

Bring-up on the repaired V1 unit: bitstream flash VERIFY OK (iceprog
build/seed4/top.bin, capture 58.36 MHz). EEPROM product string CANNOT be
programmed on V1 — U7 is a 93LC46B (128 B), too small for the FT2232H, which
needs a 93LC56B (256 B); the 128 B chip mirrors and the config write fails
verify. This overturns the old REVIEW note "93LC46B = correct for FT2232H"
(that only checked ORG, not size). Board still works blank -> ROM defaults;
iceprog + UART unaffected. Documented in REVIEW.md + TODO.md (swap U7->93LC56B
for V2); flash_ftdi_eeprom.py detects the mirroring and refuses the write.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hardware/re-bba-rb/REVIEW.md

@@ -74,8 +74,23 @@ datasheet extraction, WebSearch/WebFetch for parts and reference designs.
   change); TEST→GND, AGND→GND.
 - **EEPROM 93LC46B (U7)**: interface **was wrong** (DO+DI both direct to
   EEDATA) → fixed per DS Table 3.4: EE_DO net, R30 2.2k (C25879) to EE_DATA,
-  R31 10k (C25744) pull-up to 3V3, DI direct. 93LC46B = fixed 16-bit org =
-  correct for FT2232H. Verified in netlist.
+  R31 10k (C25744) pull-up to 3V3, DI direct. 93LC46B = fixed 16-bit org (that
+  part of the earlier verdict stands). **Interface wiring verified in netlist.**
+- **⚠️ U7 PART IS UNDERSIZED — found at bring-up 2026-08-22 (overturns the old
+  "93LC46B = correct for FT2232H" note, which only checked ORG, not size).**
+  The 93LC46B is **1 Kbit = 128 bytes**; the FT2232H addresses a **256-byte**
+  EEPROM (`max_eeprom_size=256`) and its config does not fit in 128 B. FTDI
+  specs a **93LC56B (256 B)** or 93LC66B for the H-series — the 93LC46 is for the
+  FT232R / FT2232**D**. Empirical evidence (pyftdi on the repaired V1 unit): the
+  128-byte chip mirrors into the upper half (`has_mirroring=True`); a config
+  write mirror-clobbers word 0x80→0x00 and **fails verify at word 0x02**; and
+  `set_property` indexes past byte 128. **Consequence:** the "re-BBA-rb" product
+  string CANNOT be stored on V1. **Not a functional defect** — with U7 left
+  blank the FT2232H uses ROM defaults ("Dual RS232-HS", 0403:6010), and iceprog
+  (bitstream flash — verified OK on this unit) + the channel-B UART work
+  normally. **Fix for a future rev:** fit a 93LC56B at U7 (same SOIC-8, fixed
+  16-bit org, pin-compatible). Tooling: `hardware/re-bba-rb/flash_ftdi_eeprom.py`
+  detects the mirroring and refuses the write; `--erase` blanks U7.
 - **EE_CS pull-down (R43, 10 kΩ) — ADDED 2026-07-31.** FT2232H DS Table 3.4
   states EECS/EECLK/EEDATA are all **"Tri-State during device reset"**, so CS
   floats while the FT2232H is in reset. The Microchip 93LC46B DS is explicit:
@@ -102,7 +117,10 @@ datasheet extraction, WebSearch/WebFetch for parts and reference designs.
   CDONE=ADBUS6, CRESET=ADBUS7 (verified against iceprog.c; old ADBUS3/ACBUS0/
   ACBUS1 now NC). R11/R12 10k pull-ups on CRESET/CDONE intact.
 - **EEPROM contents decision**: ship blank (default 0403:6010 = what iceprog
-  opens). Documented in TODO.
+  opens). Documented in TODO. **Update 2026-08-22:** on V1 this is now *forced*
+  blank, not just a choice — U7 (93LC46B) is too small to hold an FT2232H config
+  (see the U7-undersized note above), so the product string can't be programmed
+  until a 93LC56B is fitted. Blank is the correct, working state.
 
 ## 4. FPGA sheet (`Fpga.kicad_sch`) — FULLY REVIEWED, PASS