Thermal monitoring: surface chip thermal meter + health bucket

[josephnef]

What

Adds a read-only thermal probe across the whole Jaguar family (RTL8812AU / 8811AU / 8814AU / 8821AU) so an operator can attribute a TX drop to the chip heating up.

The thermal meter (RF path-A reg 0x42, bits [15:10]) was already sampled inside the 8812A TX-power-tracking loop — but only there: gated to CHIP_8812, logged at debug, and never surfaced as health. This exposes it independently of the power-track correction, on every chip.

How

• RadioManagementModule::ReadThermalStatus() — reads RF[A]0x42 standalone (no chip gate, no BB-swing write) and pairs it with the EFUSE baseline → ThermalStatus{raw, baseline, delta, valid}. Path A is readable on all members.
• ThermalBucket() — classifies delta into cool/warm/hot/critical. The meter has no calibrated °C transfer function on the AU family (it's an RF/PA-bias tracking index), so the health signal is deliberately bucketed rather than presented as a fake temperature.
• RtlJaguarDevice — GetThermalStatus() (synchronous, owning-thread safe) plus an opt-in background poller (start_thermal_poller / get_thermal_snapshot) mirroring the existing queue-depth poller, with the same shared-handle concurrency caveat documented.
• Demos — honour DEVOURER_THERMAL_POLL_MS / DEVOURER_THERMAL_WARN_DELTA, emitting <devourer-thermal>raw=.. baseline=.. delta=.. status=.. lines. TX demo reads inline on its own thread (no USB contention); RX demo uses the background poller. A one-shot warn fires when delta crosses the threshold and re-arms on cooldown.
• tests/thermal_hwcheck.sh — per-chip hardware smoke test.

Jaguar-1 has no automatic hard thermal TX shutdown, so a rising delta is an early warning that the PA is heating and TX power is being backed off — not a shutdown-reason readout.

Verification

• Build green, ctest green (stream_stdin_binary).
• Hardware-tested on 8812AU / 8814AU / 8821AU: the meter reads live, delta tracks PA heat from a cold start (e.g. 8812 cold delta=+0 cool → sustained TX equilibrium delta=+10 warm, ~17.5k frames confirmed sending), and the bucket + warn move correctly with physical state (including reading cool right after a physical detach). An 8811AU rides the same code path automatically (none on the bus to test).

🤖 Generated with Claude Code