Correct EEPROM soft-brick record: partial write on undersized U7 kills enumeration

Hardware bring-up correction (Dennis, 2026-08-22): writing the FT2232H product
string to the undersized 93LC46B (U7) does NOT harmlessly fail — the partial,
mirrored write lands a checksum-valid-but-garbage config, and the FT2232H then
FAILS USB enumeration entirely (dead silent, no dmesg attach). It does NOT fall
back to ROM defaults; only a blank/checksum-invalid EEPROM does. The earlier
claim that "a bad EEPROM always falls back and still enumerates" was WRONG.

Recovery (confirmed working): power on with U7 CLK shorted to GND so the FT2232H
can't read a valid config -> forces ROM defaults -> enumerates -> then erase U7.

Updated REVIEW.md, TODO.md, the flash-re-bba-rb skill (do-not-program warning +
recovery, native-Linux troubleshooting), and flash_ftdi_eeprom.py comments/help
to state the soft-brick reality. The script already refuses the write on
mirroring detection; --force now documented as "reproduce the soft-brick".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hardware/re-bba-rb/TODO.md

@@ -361,12 +361,17 @@ Major work this session:
 - [ ] **U7 EEPROM undersized — swap 93LC46B → 93LC56B for V2 (found at bring-up
       2026-08-22).** The 93LC46B is 128 B; the FT2232H needs ≥256 B (93LC56B /
       93LC66B) to hold its config, so the "re-BBA-rb" USB product string can't be
-      programmed on V1 (write mirrors + fails verify — see REVIEW.md "U7 PART IS
-      UNDERSIZED"). **Not a functional blocker:** V1 ships with U7 blank → FT2232H
-      ROM defaults ("Dual RS232-HS", 0403:6010); iceprog bitstream flash (VERIFY
-      OK on the repaired unit) and the channel-B UART are unaffected. 93LC56B is
-      the same SOIC-8 / fixed-16-bit-org, pin-compatible drop-in. Pick a JLC part
-      (e.g. 93LC56BT-I/SN) when respinning.
+      programmed on V1. **⚠️ Worse than cosmetic: ATTEMPTING the write SOFT-BRICKS
+      the FT2232H** — the partial/mirrored write leaves a checksum-valid-garbage
+      config and the chip then fails USB enumeration entirely (dead silent, no
+      dmesg). It does NOT fall back to ROM defaults; only a blank/invalid EEPROM
+      does. **Recovery (done, works):** power on with U7 CLK shorted to GND →
+      forces ROM defaults → enumerates → then erase U7. See REVIEW.md "U7 PART IS
+      UNDERSIZED". **Do NOT run the string write on V1** (`flash_ftdi_eeprom.py`
+      refuses via mirroring detection). Blank U7 is the correct state: iceprog
+      bitstream flash (VERIFY OK on the repaired unit) + the channel-B UART work
+      normally. 93LC56B is the same SOIC-8 / fixed-16-bit-org, pin-compatible
+      drop-in (e.g. 93LC56BT-I/SN) for the respin.
 - [x] RSET_BG 12.4 k — ACCEPTED 2026-07-18 (closed, no change): datasheet
       says 12.3 kΩ, but that is an E192 value with no JLC Basic part —
       WIZnet's own reference synthesizes it as 12 k + 300 Ω. The 0.8 %