wip: async BT firmware download attempt — DO NOT MERGE, breaks AX211 bring-up

Deferring the Intel BT firmware download off the boot path made the AX211
bootloader stop answering after the first FC05; even the final synchronous
revert freezes boot, so one of the 'neutral' fixes kept in this diff breaks
the bring-up on its own (candidates: BT-TRACE logging inside TransferCallback,
unconditional interrupt-IN re-queue after error completions on a halted EP,
xHCI interrupt-IN ZLP len fix interacting with HID, InPollContext owner
check).  Full history + next experiments in memory notes, 2026-07-05/06.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kernel/src/Drivers/USB/Bluetooth/Hci.hpp

@@ -265,6 +265,12 @@ namespace Drivers::USB::Bluetooth::Hci {
     // Returns true if a matching bond was found and forgotten.
     bool ForgetBond(const uint8_t* addr);
 
+    // Toggle the bounded firmware-phase interrupt-IN trace (one log line per
+    // completion, capped) plus mailbox-overwrite flags.  Enabled by the
+    // deferred bring-up so a failing hardware boot log shows exactly what the
+    // event pipe delivered.
+    void SetFwTrace(bool on);
+
     // Non-blocking peek at the most recent 0xFF/0x06 secure-send result without
     // consuming it.  Returns true if one has arrived since the last
     // ClearSecureSendResult().  The payload loop uses this to catch a mid-stream