R3-2 slice 1: read the die's DNA over JTAG (Refs #6655) #7439

Part of epic #6655, Round 3 item R3-2 (device-rooted identity), slice 1.

Goal

Read the XC7A200T die's device DNA live over JTAG, with no user bitstream, and pin every decision about it in a t27 spec. An IDCODE (0x03636093) names the part, not the die, and a host key cannot tell two dies apart; the 57-bit DNA can. This slice only reads and defines the DNA. Binding it into the signed receipt message is a later slice.

Approach

• UG470 lists two JTAG routes to the DNA: FUSE_DNA (IR 0x32, 64-bit readout) and XSC_DNA (IR 0x17, between ISC_ENABLE 0x10 and ISC_DISABLE 0x16). Try both on the attached QMTech Wukong board through the existing MPSSE transport (tools/jtag/mpsse_jtag.py), record the raw shifted bits, and work out from the data which 57 bits are the DNA and in which order.
• Cross-check against an independent reader: openFPGALoader --read-dna.
• specs/verified/device_dna.t27 holds the decisions: IR length, opcodes, how the raw 64-bit shift decodes to the 57-bit DNA, well-formedness (not all-zero, not all-ones, reserved bits as observed), fixed-width hex rendering, and the rule for two reads agreeing. Tests use the live raw values as vectors, plus negative cases.
• The Python glue under tools/jtag/ only shifts the instructions and prints the raw DR bits as hex. It does no decoding.

Acceptance

• Repeated live reads return identical raw values, and the instructions that work agree on the 57-bit DNA.
• t27c test-report specs/verified/device_dna.t27 reports 0 vacuous tests, run on the Railway lab.
• A mutation check of about 15 mutants, with the score in the spec header.
• Seal committed under .trinity/seals.
• Live reading posted on this issue: raw hex, decoded DNA, instruction, repeat count, date, board.
• Hand-written foreign code stays inside the own-language budget (at most 40 lines per file, 80 per diff).
• Pending: once a second board is attached, distinct dies must give distinct DNA.

Boundary

• Does not touch specs/verified/signed_receipt.t27; PR verified: t27c runs receipt decisions, message and hex generated from signed_receipt.t27 (Refs #7332) #7416 is changing it. Binding the DNA into the signed message is slice 2.
• No reflashing, and no Verilog DNA_PORT wrapper. If JTAG readout fails, that is reported as the blocker.
• No gate files edited (specs/policy/own_language.t27, lefthook.yml, .github/workflows/own-language.yml, tools/policy/foreign-exceptions.txt, gen/c/policy/*).