fix(arm): refuse bounded waits before the tick, and name the boot stages

[nehalkpatel]

Follow-on to #41. Adds docs/BOOT_FLOW.md, closes a latent hang, and corrects
an invariant #41 stated wrongly.

The bug

Millis() does not advance until InitSysTick() runs in Board::Init(), so
(Millis() - start) > timeout can never become true before that point.
I2CBus's flag wait and Usart::Receive both compared against that frozen
counter with no guard — a bus held low before the tick would spin forever,
with the timeout silently doing nothing. Both now return kInvalidState.

Unreachable today: both are called only after Board::Init() has run. It
becomes reachable the moment anything talks to a device during bring-up, which
is exactly what documenting an off-chip bring-up stage invites — so the guard
and the document belong together.

The design

A peripheral's stage is decided by what can fail, not by what is convenient:

• On-chip bring-up is register writes against hardware soldered into the
  die. Nothing can be absent, nothing can time out. It cannot fail, so it lives
  in a constructor — which is what makes an unconfigured peripheral unreachable.
• Off-chip bring-up is I/O across a wire, where absence and silence are
  normal outcomes. It needs somewhere that can report one: Board::Init().

That structure already existed; the contract was what was missing.
board::Board now states it where a reader meets it, and docs/BOOT_FLOW.md
carries the verified reset sequence, the stage table, a decision tree for
placing a new peripheral, and worked examples for an I2C sensor, SPI flash, a
UART-attached radio and an ADC sensor.

The ADC is the case that shows the split is not "sensor or not": the ADC
peripheral is stage 1, the sensor wired to it is stage 2.

Correction to #41

mcu::Delay does work before the tick — delay.cpp falls back to a
DWT->CYCCNT spin — so #41's "bring-up must not call mcu::Delay" was wrong.
The real boundary is narrower and sharper: a stage 1 constructor may wait, but
may not talk, because every real transfer needs a timeout.

Deliberately not done

Both written down so the next step is a decision rather than a drift:

• A timebase valid from reset (Micros() on DWT->CYCCNT) would make
  timeouts work in every stage and dissolve this boundary entirely. Worth doing
  when a stage 1 peripheral needs a bounded wait — not before.
• Explicit init levels (Zephyr's PRE_KERNEL_1 / POST_KERNEL) would
  replace the two-phase split. Trigger: two off-chip devices with an ordering
  constraint between them. Until then it is a framework guarding a state that
  has not occurred.

Known gaps, recorded not solved

• common::Error carries no payload, so Board::Init() cannot name which
  device failed. This lands before stage 2 has real occupants.
• There is nowhere to report a bring-up failure to — the console is a stage
  3 resource the application brings up.
• An RTOS will want SysTick for itself, and will likely revisit this ordering.

Verification

Check	Result
nucleo-f767zi-debug / -release	green
host-debug / host-release	33/33
tools/format.sh --check	clean
Doc links in BOOT_FLOW.md	all resolve

Costs 236 bytes of .text on i2c_demo for the guards. No hardware boot —
the guarded paths are unreachable without a device on the bus, so this is
build-and-host evidence only.

🤖 Generated with Claude Code