EXI bring-up: device enumerates on hardware over the J4 header

First silicon proof of the EXI capture path.  A Pi bit-banging EXI into J4
reads the device ID 04 02 02 00 21/21, NWAYS 0x17, HIPR 0x01, writes and reads
back PAR0-3, writes IMR, and sees NCRA's reset bit self-clear.

Fixes two host-side bugs found getting there:
- exi_devid_rpi.py sampled MISO just after the rising edge, racing the slave's
  own update and landing one bit early (04 came back as 08).  Sample in the
  CLK-low phase, as the simulation does.
- pi-exi-wirecheck.py's bridge scan drove HIGH against pull-downs, but the
  FPGA's SB_IO pull-up out-pulls the Pi's internal pull-down, so every pin
  reported as bridged.  The aggressor now drives LOW against pull-ups.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hardware/re-bba-rb/exi_devid_rpi.py

@@ -43,8 +43,12 @@ def xfer(b):
     for i in range(7, -1, -1):
         GPIO.output(MOSI, (b >> i) & 1)  # MOSI stable while CLK is high
         GPIO.output(CLK, 0)              # falling edge -> FPGA samples MOSI
-        GPIO.output(CLK, 1)              # rising edge  -> FPGA drives MISO
+        # Sample MISO HERE, while CLK is low.  The FPGA drives MISO on the
+        # RISING edge, so reading just after that edge races the slave's own
+        # update and lands one bit position early (04 02 02 00 comes back as
+        # 08 ...).  The low phase is when the bit is settled.
         r = (r << 1) | GPIO.input(MISO)
+        GPIO.output(CLK, 1)              # rising edge -> FPGA drives next bit
     return r