ehci: bound all init waits; stop auto-rescanning; wider boot watchdogqemu

Hardware run 3 showed the same PED=0 SETUP halt and then never reached the
prompt.  Two boot-time hazards explain the death:

- reset_port polled PED with a 2,000,000-iteration MMIO loop (seconds on real
  silicon) and the reset retry ran it twice per port, so the port scan alone
  exceeded the boot watchdog window (task 0 in one frame for 7.5 s panics).
- while no HID was found the cursor task re-ran the whole EHCI scan, port
  resets included, every second -- a rate-matching hub never settles.

Changes:
- every EHCI wait is wall-clock bounded: halt/reset/run 500 ms, PED 200 ms
- control-transfer timeout 5 s -> 500 ms
- per-controller 3 s port-scan budget; no automatic re-scan (explicit
  `usb rescan` only)
- 300 ms power-up settle before the reset walk (RMH bring-up)
- boot-phase watchdog 750 -> 2000 ticks (20 s), room for hub bring-up
- xHCI gets the same persistent bottom-row port/device summary

1 files changed, 1 insertions, 1 deletions

diff --git a/rsnix/src/sched.rs b/rsnix/src/sched.rs
index 107dba6..d148164 100644
--- a/rsnix/src/sched.rs
+++ b/rsnix/src/sched.rs
@@ -198,7 +198,7 @@ const WATCHDOG_SPIN_TICKS: u32 = 1500;
 /// Boot-phase threshold for task 0 (the shell): before the REPL is live,
 /// task 0 runs init code where a fixed frame means a driver/controller
 /// hang — panic after ~15 s wall.  The boot must finish well inside this.
-const WATCHDOG_BOOT_SPIN_TICKS: u32 = 750;
+const WATCHDOG_BOOT_SPIN_TICKS: u32 = 2000; // 20 s: room for hub/USB bring-up
 
 /// True once the shell REPL is live (set by main.rs before shell::run()).
 /// The shell legitimately blocks on its message queue once live;