dcd(ci_hs): stale overlay fix; run usbtest on lpcxpresso43s67

- dcd_edpt_stall flushes the primed buffer (ENDPTFLUSH), but the aborted
  transfer's dQH overlay can be left ACTIVE with mid-transfer state; the
  next prime after clear-halt then resumes the stale overlay instead of
  loading the fresh qtd, so post-halt IN reads return mid-buffer data
  (usbtest case 13 'buf[32] = 56 (not 0)', with case 18 failing
  downstream of the same corruption in the full battery). qhd_start_xfer
  now clears overlay.active alongside overlay.halted before linking the
  new qtd.
- test/hil(hfp): drop lpcxpresso43s67's device/usbtest skip - the
  historical first-case wedge no longer reproduces on this branch, and
  with the overlay fix the board runs 30/30 on its Fresco xHCI host
  (previously 28/30 with deterministic case 13/18 failures).
  mimxrt1064_evk (imxrt dcache path) 30/30 regression-clean.
- docs(hil skill): document the external hifiphile rig - pool
  test/hil/hfp.json, SSH-reachable from htpc/ci with no outbound SSH,
  exercised by the CI hil-tinyusb (hfp.json) job; never run HIL against
  it during development unless the user explicitly asks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TQZrFfU3K4Y198aLsUpBC

test/hil/hfp.json

@@ -31,9 +31,7 @@
             "name": "lpcxpresso43s67",
             "uid": "08F000044528BAAA8D858F58C50700F5",
             "tests": {
-                "device": true, "host": false, "dual": false,
-                "skip": ["device/usbtest"],
-                "comment": "usbtest skipped: ip3511 HS wedges from the first control case (1/30); needs on-rig debugging"
+                "device": true, "host": false, "dual": false
             },
             "flasher": {
                 "name": "jlink",