Fix AGC attack path to never increase gain on saturation (#145)

[lekkalaharsha]

Summary

• The `else` branch in the AGC attack guard (`agc_base_gain = min_gain`) could increase gain when `min_gain > agc_base_gain`, driving the LNA into a higher-gain state during a saturation event — unsafe hardware behavior.
• Replaced with a saturating subtract: the attack path does nothing when `agc_base_gain` is already at or below the floor, guaranteeing gain never increases on saturation.
• Added `configure()` with `min_gain <= max_gain` validation and automatic `agc_base_gain` clamping to the new range.

Closes #145.

Changes

• `ADAR1000_AGC.cpp` — rewrite attack path with saturating subtract; add `configure()` implementation
• `ADAR1000_AGC.h` — declare `configure()`
• `tests/test_agc_outer_loop.cpp` — two new regression tests (`test_saturation_never_increases_gain`, `test_configure_validation`); all 15/15 pass

Test plan

• `cd 9_Firmware/9_1_Microcontroller/tests && make clean && make` — all 15 AGC tests pass
• `cd 9_Firmware/9_2_FPGA && bash run_regression.sh` — no FPGA regressions
• `uv run ruff check .` — no lint errors

[lekkalaharsha]

Hi @soufianebouaddis, applied your holdoff_frames == 0 feedback — commit c5cb5a5.

What changed:

• configure() now rejects holdoff_frames == 0 and returns false with no fields written — same pattern as the existing min_gain > max_gain guard
• Added DIAG_WARN on both rejection paths so invalid runtime configs leave a trace even if the caller ignores the return value
• Added regression case in test_configure_validation: configure(..., 0) == false and verifies holdoff_frames is left unchanged
• Updated the configure() doc comment in the header to document the new constraint

All 15/15 tests pass.

[lekkalaharsha]

Hi @soufianebouaddis, applied all three guards — commit f05ab2c.

Changes:

• gain_step_down == 0 → rejected; attack path becomes permanently disabled (gain never decreases on saturation)
• gain_step_up == 0 → rejected; recovery path becomes permanently disabled (AGC locks at floor after first saturation)
• max_gain > 127 → rejected; exceeds the 7-bit ADAR1000 VGA register range

All three follow the existing atomic-reject pattern — no fields are written on a rejected call, so partial configuration is impossible regardless of call order.

Three regression tests added (test_configure_rejects_zero_step_down, test_configure_rejects_zero_step_up, test_configure_rejects_max_gain_out_of_range). The boundary test verifies max_gain == 127 is accepted and max_gain == 128+ is rejected.

18/18 tests pass. PR #154 is ready for re-review.

[lekkalaharsha]

@NawfalMotii79 — @soufianebouaddis has approved this PR. All five configure() guards are verified, implementation and docstring agree, and the atomic-reject pattern is intact across every path.

Ready to merge. Please squash merge into develop — the current PR title and description are suitable as the final commit message.