feat(rtl,gui): PR-U / M-8 — sub-frame enable mask routed end-to-end (C-5 hardening)

The chirp_scheduler had a 3-bit host_subframe_enable input {LONG, MEDIUM, SHORT}
that was tied to the constant RP_DEF_SUBFRAME_ENABLE at the receiver instance,
so the host could neither change it nor know what mask was active. With the
mask not at 3'b111 the scheduler skips a sub-frame at TX but doppler_processor
still writes 48 chirp slots, so the host CRT (`dbin // 16 → {SHORT, MED, LONG}`)
silently mis-attributes the SF axis and unfolds to the wrong velocity.

Plumb the mask through:

- radar_system_top.v: new reg [2:0] host_subframe_enable, cold-reset
  RP_DEF_SUBFRAME_ENABLE, opcode 0x19 setter, wired to rx_inst and usb_inst.
- radar_receiver_final.v: new host_subframe_enable[2:0] input port; the
  chirp_scheduler instance is untied from the constant.
- usb_data_interface_ft2232h.v: new subframe_enable[2:0] input + per-frame
  snapshot reg latched at frame_complete (stable for ft_clk read, same
  pattern as stream_flags_snapshot). Byte 2 emission is now
  {2'b00, subframe_enable[2:0], stream_flags[2:0]} — was {5'b00000, stream}.
- radar_protocol.py: Opcode.SUBFRAME_ENABLE = 0x19; RadarFrame.subframe_enable
  field; parse_bulk_frame surfaces bits[5:3]; reserved-mask 0xF8 → 0xC0.
  Bulk-frame mock encodes the mask in its emit so dashboard replay is correct.
- v7/processing.py: extract_targets_from_frame_crt forces every target to
  AMBIGUOUS when frame.subframe_enable != 0b111. Operator sees the red `?`
  flag in the targets table instead of a silently-wrong velocity.
- v7/software_fpga.py + v7/dashboard.py: subframe_enable mirror + setter, and
  replay dispatch routes 0x19 to set_subframe_enable.

Tests (test_v7.py): TestSubframeEnableRoundTrip (4), TestSoftwareFpgaSubframeEnable
(2), TestCrtSubframeMaskGating (3), 0x19 added to TestOpcodeEnumFillIn and
TestReplayOpcodeDispatch. Existing test_full_frame_round_trip updated to expect
byte 2 = 0x3F (mask 0b111 default + stream 0x07).

Cosim TBs (tb/tb_usb_protocol_v2.v, tb/tb_ft2232h_frame_drop.v) drive the new
input with 3'b111 and assert the new byte-2 layout (T2.3: 0x00 → 0x38).

Regression: test_v7 146/146, test_GUI_V65_Tk 117/117, ruff clean.
iverilog: tb_usb_protocol_v2 27/27 PASS, tb_ft2232h_frame_drop 10/10 PASS.

9_Firmware/9_3_GUI/v7/processing.py

@@ -698,6 +698,15 @@ def extract_targets_from_frame_crt(
             gps=gps,
         )
 
+    # PR-U / M-8: when the operator disabled a sub-frame at the FPGA, the
+    # chirp_scheduler runs only the enabled SFs but doppler_processor still
+    # emits 48 chirp slots — `dbin // 16 → {SHORT, MED, LONG}` no longer
+    # attributes correctly. Force AMBIGUOUS for every target so the dashboard
+    # column flags it red. Default 0b111 keeps the production happy path on
+    # the CONFIRMED branch via the normal CRT logic.
+    sf_mask = getattr(frame, "subframe_enable", 0b111) & 0x07
+    sf_mask_invalid = (sf_mask != 0b111)
+
     chirps_per_sf = waveform.chirps_per_subframe  # 16
     v_res_per_sf_all = [
         waveform.velocity_resolution_short_mps,
@@ -746,6 +755,8 @@ def extract_targets_from_frame_crt(
         v_est, confidence, alias_set = unfold_velocity_crt(
             v_meas_list, v_unamb_list, v_res_list, max_alias_k=max_alias_k,
         )
+        if sf_mask_invalid:
+            confidence = "AMBIGUOUS"
 
         range_m = float(rbin) * range_resolution
         snr = 10.0 * math.log10(max(peak_mag, 1.0)) if peak_mag > 0 else 0.0