Filter RX to own-MAC + broadcast: unfiltered MACRAW hung Swiss

Compat TODO item 1.  S0_MR now sets the MACRAW MF bit, so the W5100 delivers
frames addressed to SHAR or broadcast only -- what the real BBA does, since
libogc2 configures NCRB = AB|CA|2_PACKETS_PER_INT (PR=0, PM=0, AB=1).
NCRB.PR (bit 0) clears MF if the GC asks for promiscuous, sampled when socket 0
is OPENed, so a later PR change applies on the next NCRA reset.

This was not a performance issue, it was a HANG.  Swiss sat on "Initialising
Network" forever.  libogc2's bba_interrupt() loops

  while (status) { clear IR; start_rx; status = IR & IMR; }

which only exits when IR & IMR reaches zero.  Unfiltered, every frame on the
segment set RI, re-asserting faster than the loop could clear it, so it never
exited.  Unplugging the ethernet cable let Swiss run all the way through and
then fail DHCP for want of a server -- a one-minute experiment that identified
it after a lot of theorising about descriptors and interrupts.

Filtering against SHAR turned out to be safe for this path after all.  The
earlier worry was that MF filters on SHAR, which we write only at init, so a
driver WRITING PAR0-5 would leave it stale and MF would drop everything.
libogc2 READS the MAC out of PAR0-5 instead, so SHAR -- written from reg.par in
that same init -- cannot go stale underneath it.  Broadcast still passes MF and
a DHCP OFFER unicast to our MAC passes too.

Left open and recorded: refreshing SHAR on a PAR0-5 write plus a socket
re-open, for a driver that does write it (the official SDK driver is unread).
The W5500 back-end is unchanged, being the unused alternate path; it would need
the same Sn_MR treatment if revived.

T1 expects S0_MR = MACRAW|MF in the init sequence, T1b checks promisc high
re-inits with MF clear.  Mutation-tested: never setting MF fails both.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -1359,12 +1359,14 @@ Known differences between this implementation and what real GC software
 expects, with the evidence for each, are tracked in
 **`docs/bba_compat_todo.md`**. Summary of what is still OPEN:
 
-1. **No hardware RX filtering** — ⚠️ STILL OPEN. We take every frame on the
-   segment; the real BBA delivers own-MAC + broadcast. Causes the ring
-   pressure already seen on hardware. Needs a decision, not just code: the
-   W5100's MF bit filters against `SHAR`, which we write only at init, so a
-   driver that writes PAR0–5 would leave it stale and MF would drop
-   everything.
+1. ✅ **Hardware RX filtering** — `S0_MR` sets the MACRAW **MF** bit, so the
+   chip delivers own-MAC + broadcast only; `NCRB.PR` clears it for
+   promiscuous. Running unfiltered **hung Swiss** on "Initialising Network":
+   libogc2's `bba_interrupt()` loops until `IR & IMR` is zero, and every
+   frame on the segment re-set `RI` faster than it could clear them, so it
+   livelocked. Unplugging the cable let Swiss through, which identified it.
+   Still to do: refresh `SHAR` on a PAR0–5 write (libogc2 reads the MAC
+   rather than writing it, so this path is safe today).
 2. ✅ **Ring geometry** — `BP`/`RHBP` are honoured, with garbage rejected and
    `geom_honoured` exposed. A ring must still be larger than
    `_MAX_FRAME_PAGES` (6) or the worst-case reservation drops every frame.