Follow-ups left open by the busy-window session-lifetime fix (#442)

[josephnef]

Left open by the busy-window session-lifetime fix (#442, merged as 09eb26a). Closes item 2 of #441.

1. An arm issued AFTER Stop() still succeeds on Jaguar1/2/3

#442 makes Stop() forget a window armed before the teardown. It does not close the other direction: with_ccx on the three Jaguar families gates on _brought_up, which no Stop() clears, so ArmChannelBusy() after a Stop() arms a torn-down chip and the read touches CCX registers on it. The RTL8733B closes this (its Stop() clears _phy_ready under the recursive _reg_mu it holds for the whole body); the Jaguars have neither half. Documented at IRadio::ArmChannelBusy and in each src/<gen>/CLAUDE.md.

Closing it means clearing _brought_up in the Jaguar Stop()s, which gates other paths (the band_change TXAGC re-fold in FastRetune, among others), so it is a behaviour change on its own and wants its own measurement — tests/busy_window_probe.sh --mode revive reps 2..N are exactly the sequence that would start refusing.

2. Jaguar2/3 with_ccx reads _brought_up before taking _reg_mu

Both overrides check the flag unlocked and then take _reg_mu. The RTL8733B override's comment already names the shape: a data race on the flag, and a TOCTOU where the check passes, the lock blocks behind a concurrent Stop(), and the register access proceeds against a card that has just been powered down. Pre-existing; with_ccx is single-control-thread by contract so it is latent, but it costs nothing to read the flag under the lock, and item 1 makes the flag load-bearing.

3. tests/busy_window_probe.sh: stale arm body left indented

#442 removed the tautological if [ "$realtek_sensor" = "1" ] around the stale arm but left its body indented one level. Cosmetic.