Artemis Milestone 2g: TEST UNIT READY unit-init sequence -- READ(10) now PASSes

Roots out the CSW status FAILED left unexplained in the prior increment: a
freshly attached SCSI target's standing UNIT ATTENTION condition, which a
bare READ(10) with no retry can never clear. xhci_bot_send_test_unit_ready()
sends SCSI TEST UNIT READY (SPC-4 6.33) ahead of the real command; the CSW
handler now tags command kind (bot_cmd_kind) to distinguish a TUR completion
from a READ10 completion, chains TUR PASS into the real READ(10), and
bounded-retries TUR on FAILED/PHASE ERROR (bot_tur_retries, capped at
XHCI_BOT_TUR_MAX_RETRIES). xhci_bot_read_block() is the new intended entry
point tying lba/num_blocks/block_size + the TUR-first sequencing together.

Verified live via a temporary probe (hot-attached disk/usb-thumbdrive-test.img
through the running instance's QMP socket), captured on amd64: full chain
CBW(TUR) -> FAILED -> retry -> PASS -> CBW(READ10) -> Data-In -> CSW PASS.
Probe reverted after capture; all three architectures re-verified clean,
probe-free boot to ok>. FABRIC-2.md Section X 2g updated with the writeup.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

include/starkernel/xhci.h

@@ -306,6 +306,20 @@ typedef struct {
 #define SCSI_CMD_READ10   0x28u
 #define SCSI_CDB_LEN_READ10 10u
 
+/* SCSI TEST UNIT READY (SPC-4 section 6.33) -- 6-byte CDB, all-zero apart
+ * from the opcode, no data stage. Convention (not spec-mandated, but
+ * standard SCSI target behavior): the first command a target sees after
+ * attach fails with CHECK CONDITION/UNIT ATTENTION (media/reset notice),
+ * clearing on the next command -- issuing this ahead of a real data
+ * command and retrying it a bounded number of times on failure is the
+ * standard way to drain that condition before trusting a READ/WRITE. */
+#define SCSI_CMD_TEST_UNIT_READY    0x00u
+#define SCSI_CDB_LEN_TEST_UNIT_READY 6u
+
+/* Bounded retry count for SCSI TEST UNIT READY before giving up -- see
+ * xhci_dev_t's bot_tur_retries doc comment. */
+#define XHCI_BOT_TUR_MAX_RETRIES 3u
+
 /* Bulk-Only Transport Command Status Wrapper (same spec, section 5.2) --
  * received device-to-host on the bulk IN endpoint after the Data-In
  * stage, closing out every SCSI command. Fixed 13-byte wire layout; same