feat: port MT76 radio init and CLI tool

Complete the radio bring-up sequence: init_registers now writes the
upstream register values (PBF out of reset, beacon TX off), crystal
calibration, MAC/BSSID programming, channel evaluation, and beacon
programming through an MCU burst into PBF shared memory. The beacon
txwi is the full 20-byte struct and the RF patch is applied on the
cold firmware path.

Download firmware per product (xone_dongle_02e6.bin / 02fe.bin) and
add the xone_cli debug tool (info, firmware, radio-init/deinit, burst,
reg-read/write, led, recover). Recover uses USBDeviceReEnumerate for a
host-side port reset.

Co-Authored-By: grok4.6: internet search (firmware split, beacon SRAM, upstream issues)
Co-Authored-By: qwen3.8-27b@q2_k_xl: initial radio init and CLI implementation
Co-Authored-By: deepseek/deepseek-v4-pro-0813: final radio init fixes and verification

CMakeLists.txt

@@ -6,7 +6,7 @@ if(NOT CMAKE_GENERATOR MATCHES "^(Ninja|Xcode)$")
 endif()
 
 cmake_minimum_required(VERSION 3.21)
-project(xone_macos VERSION 0.1.7 LANGUAGES CXX Swift)
+project(xone_macos VERSION 0.1.8 LANGUAGES CXX Swift)
 
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 
@@ -103,6 +103,16 @@ target_compile_options(xone_app PRIVATE
     -import-objc-header "${CMAKE_SOURCE_DIR}/include/app/xone_api.h"
 )
 
+# ==============================================================================
+# Command line tool (protocol stack debugging against hardware)
+# ==============================================================================
+add_executable(xone_cli
+    "src/cli/main.cpp"
+)
+target_include_directories(xone_cli PRIVATE "${CMAKE_SOURCE_DIR}/include")
+target_compile_definitions(xone_cli PRIVATE ${BASE_DEFINITIONS})
+target_link_libraries(xone_cli PRIVATE xone_mt76)
+
 # ==============================================================================
 # Tests
 # ==============================================================================