feat: port MT76 firmware load and download script

Add chip::load_firmware(): validates the xow_dongle.bin header, DMAs
the ILM and DLM images in 0x3800-byte chunks over EP 0x04 OUT with
FCE completion polling, then loads the IVB and waits for the firmware
to start. Probe now issues a USB reset first (port of
usb_reset_device), matching xone_dongle_probe.

The chip keeps its firmware across a USB reset on macOS and does not
set the upstream reset-complete bit, so load_firmware falls back to
the running firmware when the chip is still alive. Verified on
hardware: fresh load and re-plug both return success.

Add scripts/download-firmware.sh (port of install/firmware.sh), which
fetches the driver CAB from Windows Update and extracts
firmware/xow_dongle.bin, hash-verified.

Co-Authored-By: qwen3.8-27b@q2_k_xl: ported firmware load and download script

include/mt76/mt76.hpp

@@ -41,7 +41,23 @@ public:
     // MAC address from EFUSE with the 62:45:bd fallback applied.
     auto mac_address() -> std::array<std::uint8_t, 6>;
 
+    // Load the firmware image from a file (port of xone_mt76_load_firmware).
+    // Resets the MCU if firmware is already loaded. Returns 0 or -errno.
+    auto load_firmware(char const *path) -> int;
+
 private:
+    // Send an MCU command (port of xone_mt76_send_command). `cmd` is the
+    // MT_MCU_MSG_CMD_TYPE field. Returns bytes written, or a negative errno.
+    auto send_command(std::uint32_t cmd, void const *payload,
+                      std::size_t payload_len) -> int;
+
+    // Firmware load steps (port of xone_mt76_*).
+    auto load_ivb() -> int;
+    auto send_firmware_part(std::uint32_t offset, void const *data,
+                            std::size_t len) -> int;
+    auto send_firmware(void const *fw_data, std::size_t fw_size) -> int;
+    auto reset_firmware() -> int;
+
     usb::transport &transport_;
 };