Add hi3519v101 + hi3516av200 (V3A family) to flash agent

[widgetii]

Summary

Fourth agent platform after ev300 (V4), cv300 (V3), and av300/dv300/cv500 (V5/cv500-family). V3A = 3519v101 + av200 — Cortex-A7 with V3-era peripheral addresses (UART 0x12100000, WDT 0x12080000) but DDR at 0x80000000 like cv500-family, per qemu-hisilicon's hi3519v101_soc.

The bootrom-protocol quirks (sendFrameForStart handshake, PRESTEP1 DDR training step, non-fatal TAILs) were already landed for defib install / defib burn in #47 + #48 + #65. This PR is just the agent build wiring plus one real protocol fix the agent-flash path was missing.

The fix: don't pre-truncate spl_override at the call site

defib agent upload / agent flash were doing:

```python
spl_data = cached_fw.read_bytes()[:profile.spl_max_size]
```

before passing to send_firmware(). When _send_spl() then scans this truncated buffer for the LZMA/gzip SPL boundary, it can't find anything past profile_max — so for chips where the OpenIPC SPL is larger than the HiTool reference (e.g. av200's SVB-enabled SPL is 0x6800, but profile_max is 0x4F00), we send 0x1900 too few bytes. The SPL never finishes its post-DDR-init code, the SPL TAIL completes with no follow-through, and the agent HEAD frame for 0x81000000 gets 0x08 rejection.

Fix: pass the full u-boot binary as spl_override. _send_spl() already handles the slicing via its detected LZMA/gzip boundary.

Verification

QEMU qemu-system-arm -M hi3519v101 -kernel agent-hi3519v101.elf:
agent boots cleanly, READY/DEFIB packet stream, no faults.

Real hi3516av200 board (/dev/ttyUSB1, MikroTik ether8):

```
upload ok=True
agent ready: ram_base=0x80000000 caps=0x7f version=2
```

The board in our lab has SPI NAND and the agent's NOR-only flash driver
returns shifted JEDEC bytes / 0-byte reads on NAND; that's a separate
larger limitation noted at the bottom.

hi3516cv300 regression (/dev/uart-IVGHP203Y-AF, MikroTik ether3):

```
agent ready: jedec=ef4018 flash=16384KiB ram=0x80000000 caps=0x7f
256 KiB @ 921600: 3.02 s = 84.9 KB/s
```

The spl_override-truncation fix changes cv300's SPL size from 0x4F00 (clamped) to 0x5400 (LZMA-detected at offset 0x54c8). Agent loads identically, throughput unchanged — the previous undersized SPL was working coincidentally because cv300's SPL pieces happened to fit in the smaller window.

```
make -C agent test HOST_CC=gcc: 5406/5406
pytest tests/ -x --ignore=tests/fuzz: 402 passed, 2 skipped
ruff & mypy: clean
```

All four agent SoCs (ev300, cv300, cv500, 3519v101) build clean.

Aliasing

Following the existing gk7205v300 → gk7205v200 shape: one binary serves the family, multiple chip names route to it.

```python
"hi3519v101": "hi3519v101",
"hi3516av200": "hi3519v101", # 3519v101 family, same memory map
```

Known limitation: SPI NAND on av200 boards

The av200 board in our lab has SPI NAND flash. The agent's flash driver (agent/spi_flash.c) supports SPI NOR only — uses the memory-mapped read window at 0x14000000 and direct FMC register commands. On a NAND board:

• Agent loads, runs, and emits READY ✓
• agent info returns shifted JEDEC bytes (e.g. 00c212 instead of valid c2 XX YY)
• agent read returns 0 bytes
• Erase/write/scan won't work

This affects all V3-and-later HiSilicon chips that ship with SPI NAND (some av200, some av300, some cv500). Adding SPI NAND support to the agent is its own piece of work. This PR ships the platform wiring; a follow-up can address NAND.

Test plan

• QEMU -M hi3519v101: agent boots cleanly
• Real av200 hardware: agent uploads + runs + READY
• cv300 regression: throughput and behavior unchanged
• All test suites green

🤖 Generated with Claude Code