Ch443f: coherent Gray readiness CDC + qualified scanout underflow detector

Harden the LPDDR scanout underflow diagnostic (Codex direction). Keeps the
Ch443e 4-buffer + lead-2 fix; adds no 5th buffer.

RTL (gs_lpddr_scanout_lb):
- Replace the raw-binary next_fetch readiness sync with a reset-aware GRAY
  code. next_fetch is monotonic between frames, so one Gray bit changes per
  increment; the 2-FF-synced + decoded nf_v is always a real prior frontier
  (monotone, burst-safe), never a torn multi-bit combination. (A plain
  toggle-per-change handshake dropped bursts when two increments landed in one
  sync window; that is why the earlier attempt under-read nf_v and false-tripped.)
  fs_edge_v overrides the lone multi-bit reset transient.
- Qualify the underflow: only a miss persisting >= QUAL_CYCLES (4) sets sticky
  underflow. uf_pmax_q records the longest streak and uf_qual_q whether any
  qualified, so a host can distinguish a 1-cycle CDC lag from a real late row.
- Atomic snapshot: scan_y/nf_v/pmax/causes/vphase/line_valid all latched the
  same video cycle on the first qualified miss.

ABI: 0x120 adds [15:12]=live pmax (2-FF synced via scan_diag_pmax_i). 0x124
[29:20] now carries pmax-at-capture (was nf_s0). Bridge dst reg kept 10-bit.

SDC: scanout diag bundle source count 37 -> 31 (nf_s0[10] -> pmax[4]); new
async-in cut + max_skew/net_delay for the next_fetch Gray CDC; stage-0 cut for
the live pmax sync.

Tests: new tb_gs_scanout_cdc_qual (async-clock focused: no false event from the
readiness transition or ordinary sync latency; sub-QUAL transient does not
qualify; genuine late row qualifies with a self-consistent atomic snapshot;
frame reset + mod-4 reuse re-arm the detector). tb_gs_scanout_diag updated for
the pmax field. Tie off scan_diag_pmax_i (+ pre-existing clut_* gap from the
fog baseline) in the four .* bridge/integration TBs.

Regressions green: scanout (cdc_qual, binomial_lookahead, diag, restart,
lpddr_scanout_lb x3), regbuf (r/aw/w), bridge + 3 pad integration TBs, and the
f52 top-level golden FB (Z 0/307200, COLOR 0/245760 mismatch, drops=0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sim/tb/gif_gs/tb_gs_scanout_diag.sv

@@ -229,7 +229,7 @@ module tb_gs_scanout_diag;
         chk("P1 line_valid=0",    st[5]===1'b0);
         chk("P1 snap scan_y=0",   fst[9:0]===10'd0);
         chk("P1 snap nf_v=0",     fst[19:10]===10'd0);
-        chk("P1 snap nf_s0=0",    fst[29:20]===10'd0);
+        chk("P1 snap pmax qualified (>=QUAL)", fst[29:20] >= 10'd4);
 
         // snapshot stability: later misses on a different row must NOT overwrite the first snapshot
         @(posedge video_clk) begin pixel_y<=12'd2; end
@@ -278,7 +278,7 @@ module tb_gs_scanout_diag;
         chk("P5 DUT-B captured",        b_diag_valid===1'b1);
         chk("P5 scan_y=VSS(32)",        b_diag_first[9:0]===10'd32);   // NOT 0: source row 32
         chk("P5 nf_v=32",               b_diag_first[19:10]===10'd32);
-        chk("P5 nf_s0=32",              b_diag_first[29:20]===10'd32);
+        chk("P5 pmax qualified (>=QUAL)",   b_diag_first[29:20] >= 10'd4);
         chk("P5 base=1",                b_diag_stat[0]===1'b1);
         chk("P5 line_valid=0",          b_diag_stat[2]===1'b0);
         // cause/phase packing: outputs must byte-map the internal capture regs
@@ -288,7 +288,7 @@ module tb_gs_scanout_diag;
         chk("P5 pack vphase field", b_diag_stat[6:3] === dut_b.diag_vphase_q);
         chk("P5 pack scan_y field", b_diag_first[9:0]   === 10'(dut_b.diag_scan_y_q));
         chk("P5 pack nf_v field",   b_diag_first[19:10] === 10'(dut_b.diag_nf_v_q));
-        chk("P5 pack nf_s0 field",  b_diag_first[29:20] === 10'(dut_b.diag_nf_s0_q));
+        chk("P5 pack pmax field",   b_diag_first[29:20] === 10'(dut_b.diag_pmax_q));
 
         // -------- coverage: the fs_edge-coincident-miss case was actually exercised --------
         chk("M1 coverage: fs_edge coincident with miss observed", cov_fsedge_miss===1'b1);