Rework the EXI decoder to the real GC<->BBA protocol

Replaces the invented 2-byte header (addr split across both bytes, 2-bit
length field) with the protocol libogc and Swiss actually speak:

  command  (bit7=0, 6-bit reg)   [reg, 00, 00, data]  one 4-byte transfer
  register (bit7=1, 16-bit reg)  [0x80|w<<6, ah, al, 00] + data until CS

This was not an optimisation: the old decoder read Swiss's NWAYS read
(80 00 31 00) as 'write 0x31 to NCRA', and bit 0 of 0x31 is RESET, so every
register read would have reset the device.

Changes:
  * 16-bit address; no length field -- register reads and writes now stream
    until CS, like the SPRAM path already did
  * RHDR_LO starts the SPRAM fetch as soon as the address completes, using
    the trailing header byte as the prefetch window the protocol provides
  * command space serves EXI regs 0x02/0x03 (interrupt mask/status), the only
    two Swiss uses
  * EXI_GetID gets its own path: it offers just ONE header byte of warning, so
    the first ID byte is pushed the instant byte 0 identifies the query

Two timing subtleties, both found by simulation and commented in place:
  * MISO is driven LIVE from the tx FIFO head, so a byte pushed while the pad
    byte is on the wire appears in the pad slot.  A filler byte is parked
    there (MISO is don't-care through the header) so the first real response
    lands in data slot 0.
  * the prefetch must be one-shot; re-firing while waiting for the pad byte
    consumed the register stream early and shifted reads by a byte.

All testbenches updated to the real format and passing: bba_register_file
(7), bba_top (8 incl. the full W5100->SPRAM->GC loop and TX), exi_j4,
exi_capture, spi_mode3_slave, tx_frame_drain, spram_arbiter,
rx_frame_assembler, w5100_parallel_master.  gc_bba_test rebuilt against the
new protocol.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

gc_bba_test/source/bba.h

@@ -59,15 +59,19 @@ extern u32 bba_gap_us;
 
 /* All return 0 on success, negative on an EXI-layer failure. */
 
-/* Immediate read of `len` (1..4) bytes from `addr`.
- * Clocks EXACTLY `len` bytes: over-clocking a register read leaves stale
- * prefetched bytes queued in the gateware and desynchronises the NEXT
- * transaction (hardware-confirmed 2026-09-30).  Never pad this. */
+/* REGISTER-space read: 4-byte header [0x80, ah, al, 0x00] then `len` bytes.
+ * The real protocol has NO length field -- the data phase runs until CS, so
+ * `len` is unbounded.  The trailing 0x00 header byte is the device's prefetch
+ * window.  See docs/exi_protocol_real.md. */
 int bba_read(u16 addr, void *buf, u32 len);
 
-/* Immediate write of `len` (1..4) bytes to `addr`. */
+/* REGISTER-space write: 4-byte header [0xC0, ah, al, 0x00] then `len` bytes. */
 int bba_write(u16 addr, const void *buf, u32 len);
 
+/* EXI_GetID: write 0x0000 (two bytes) then read 4.  Returns the device ID,
+ * which is a ONE-SHOT -- the first NCRA reset clears it until power cycle. */
+int bba_devid(u8 id[4]);
+
 /* Convenience single-byte helpers.  bba_r8 returns the byte, or <0 on error. */
 int bba_r8(u16 addr);
 int bba_w8(u16 addr, u8 val);