Follow-ups left open by the station-series cleanup (#466)

[josephnef]

Left open by #466 (merged as 1134df9): the station-series review follow-ups, part of the #465 harness sweep, the #461 stale-EXT claim in gate_txs, and the txdemo thread-join guards.

From the review (hardware: realtek_station_onair 5/5 on 8812CU + 8812BU + MT7612U AP; uplink A/B against master)

• gate_txs stale-EXT claim can over-attribute. One arm on the review bench read 61/60, 1 stale-EXT entries claimed, 11 foreign: the arm then received all 60 of its own entries, so the claimed one was not its own (or a MAC duplicate). Printed, not clipped, but success is inflated by one. Suggested self-correction: track own-pktid entries separately and at arm end, if own == n and stale_ext == 1, move the claimed entry back to late_prev.
• The stale_settled gate cascades. One UNSETTLED arm disables the claim for every following arm until one settles on its own - a chain of seven consecutive 59/60 arms on the review bench. Correct by the documented rule; docs/mt7612u-tx-retry.md should say the claim buys little on a unit whose arms do not settle.
• The Follow-ups left open by the station identity seam (#460) #461 multi-entry loss is far worse on a second unit. Unicast-to-peer gate arms (b-e) landed 0-11/60 own entries on both passes, ~10 per arm carrying the previous arm's pktid, identical on master. Not this PR; recorded here so Follow-ups left open by the station identity seam (#460) #461 has the second data point.
• realtek_station_onair.sh: tail_ms can be negative (-6 ms in arm C: the final tx.stats t preceded the last tx.report t). Harmless to live; clamp at 0 or note it in the summarize comment.
• mt7612u_sta_identity.sh: an overrun BSSID gate sets r_bss=2, but the verdict case has only 0, 3, *, so the operator reads "did not pass" for what the exit code calls INCONCLUSIVE. Add a 2) branch.
• mt7612u_sta_uplink.sh: dut_bound is per harness arm (552 s at FRAMES=60, 1128 s at 200) while the header's 25-minute figure covers both arms; the margin for the slower un-ACKed arm at FRAMES=200 is thin. Size it from the measured figure.
• mt7612u_ap_onair.sh: on the KILL path reap drops KIDS without waiting the killed children, leaving zombies for the rest of the run.
• Firmware readability preflight (Follow-ups left open by the station client (#464) #465 class). On a host whose MediaTek firmware is zstd-compressed (/lib/firmware/mediatek/*.bin.zst), sta_fw_link succeeds, the probe logs cannot open firmware/mt7662_rom_patch.bin, and the uplink harness scores ABORTED the DUT did not confirm retry limit 15: with an empty reason. Checking the two blobs are readable through the link turns a dead rig into a refusal in seconds.

From the PR description

• Find the uplink harness's multi-entry status loss (Follow-ups left open by the station identity seam (#460) #461).
• Unify the INT/TERM exit code across the station harnesses: realtek_station_onair, mt7612u_sta_onair and mt7612u_sta_identity exit 3; autoack, uplink and ap_onair still exit 130.
• From Follow-ups left open by the station client (#464) #465, not in cleanup: follow-ups from the station series reviews (#451-#464), part of #465 #466: the generic Realtek DUT take, the reconnect cell and the CCMP soak (separate PR).

Done by the review, no action

• The "last arm that sent" form of the stale-EXT claim is now hardware-run (it coincided with the previous-arm form: no arm had every submit fail). The claim fired correctly on the session's first arm: 60/60 with 1 claimed on cleanup: follow-ups from the station series reviews (#451-#464), part of #465 #466 against 59/60 UNSETTLED with 1 foreign on master.