fix(w5100): revert buffer base to 0x4000/0x6000 — IDM decodes only 15 bits

Reverts the 0x8000/0xC000 change from 162dbf7, which was WRONG and actively
broke transmission. The W5100S datasheet pseudo-code quotes 0x8000 (TX) /
0xC000 (RX) for the memory blocks, but the PARALLEL/indirect (IDM) interface
only decodes a 15-bit offset. Bench-proven with an address-aliasing probe:
writing distinct values to each candidate base and reading them back showed
0xC000 and 0x4000 are the SAME cell (0xC000 & 0x7FFF == 0x4000) while 0x6000
holds its own value.

Consequence of the bad base: every payload byte written to 0x9800+i aliased
down onto 0x0000+i, landing on SHAR (0x09-0x0E) and SIPR (0x0F-0x12) and
overwriting them with the payload. The chip then transmitted frames with a
garbage source MAC/IP, which the peer NIC drops without counting -- the
"SEND_OK but rx_packets=0" symptom, and the bogus SIPR0 readback (0x50 was
literally payload byte 15, 'P').

The NETLCKR unlock from 9c4bc7a is a genuine W5100S requirement and stays.

Also:
- w5100_udptest.py: self-contained configure+send+readback probe (and the
  address-aliasing probe that found this), reports over UART.
- scripts/build-flash.sh: sweep N seeds and flash the best (capture timing is
  seed-dependent, so the sweep is mandatory).
- scripts/uart-console.py: interactive UART console, plus --send/--read
  one-shot modes for scripting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/build-flash.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Build the current gateware over N nextpnr seeds and flash the best result.
+#
+# The capture domain (54 MHz) is routing-dominated and only closes on a minority
+# of seeds, so a sweep is mandatory — see CLAUDE.md.  synth.py ranks the seeds by
+# capture_clk fmax and reports the winner; this flashes that one.
+#
+#   ./scripts/build-flash.sh            # 8 seeds (default), build + flash
+#   ./scripts/build-flash.sh 12         # 12 seeds
+#   ./scripts/build-flash.sh 8 --no-flash   # build only, don't touch the board
+#
+# The socket-3 UDP bring-up test identity is set from these env vars (override
+# to match your LAN before running):
+#   UDP_SRC_IP UDP_SUBNET UDP_GATEWAY UDP_DST_IP UDP_SRC_PORT UDP_DST_PORT UDP_SOCKET
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+SEEDS="${1:-8}"
+NOFLASH="${2:-}"
+
+export UDP_SRC_IP="${UDP_SRC_IP:-192.168.2.99}"
+export UDP_SUBNET="${UDP_SUBNET:-255.255.255.0}"
+export UDP_GATEWAY="${UDP_GATEWAY:-192.168.2.1}"
+export UDP_DST_IP="${UDP_DST_IP:-192.168.2.112}"
+export UDP_SRC_PORT="${UDP_SRC_PORT:-40000}"
+export UDP_DST_PORT="${UDP_DST_PORT:-6464}"
+export UDP_SOCKET="${UDP_SOCKET:-3}"
+
+LOG="$(mktemp -t bbabuild.XXXXXX.log)"
+echo "==> building $SEEDS seeds (log: $LOG)"
+echo "    UDP: ${UDP_SRC_IP}:${UDP_SRC_PORT} -> ${UDP_DST_IP}:${UDP_DST_PORT} (socket ${UDP_SOCKET})"
+
+python -m exi_bba.synth --seeds "$SEEDS" 2>&1 | tee "$LOG"
+
+# synth.py prints:  "Bitstream for best seed: build/seedN/top.bin"
+BIN="$(grep -aoE 'build/seed[0-9]+/top\.bin' "$LOG" | tail -1 || true)"
+if [ -z "$BIN" ] || [ ! -f "$BIN" ]; then
+    echo "!! no best-seed bitstream found — check the log above" >&2
+    exit 1
+fi
+grep -aE 'Best seed' "$LOG" | tail -1 || true
+
+if [ "$NOFLASH" = "--no-flash" ]; then
+    echo "==> built $BIN (not flashing, --no-flash given)"
+    exit 0
+fi
+
+echo "==> flashing $BIN"
+iceprog "$BIN" 2>&1 | grep -aE 'VERIFY|cdone|Error|error|Bye' || true
+echo "==> done"