fix(uci): bounded uci_wait_idle + connect short-read detection + Labels.from_file parser convergence

[JC-000]

Summary

Three independent improvements uncovered while triaging widespread test-suite failures (c64-test-harness#90 → routed here as #36/#37):

1. fix(uci) — bound uci_wait_idle to a 5 s wall-clock budget via CIA1 TOD, and detect net_tcp_connect short-read on the OPEN_TCP response so a phantom socket is rejected with C=1 instead of being silently committed to the TLS layer. Together these convert a non-deterministic firmware OPEN_TCP failure from a 600 s sentinel hang into an immediate, well-typed error.
2. chore(tools/uci) — converge 5 UCI test scripts onto the harness's Labels.from_file() instead of bespoke parsers that crash on raw 6-digit ld65 labels (al 022100 .REU_OVERLAY_P256 and friends). Two were crashing today; three were latent.
3. docs(uci) — promote the "wall-clock timeouts only" design note from "future work" to "implemented for uci_wait_idle, copy this template" and document the new UCI_ERR_* / UCI_TCP_CONNECT_FAIL codes.

Fixes#36
Fixes#37

Detail

#36 — net_tcp_connect unconditional CONNECTED on short-read

src/net/uci/net.s previously set net_tcp_state = UCI_TCP_CONNECTED (0x01) regardless of whether uci_read_resp_bytes returned a real socket-id byte. A short response left uci_socket_id = 0, the C64 proceeded to TLS, and the ClientHello was pushed via SOCKET_WRITE on a phantom socket.

Fix: pre-zero uci_socket_id, validate uci_resp_count != 0 AND uci_socket_id != 0 post-read, on failure set net_last_error = UCI_ERR_NO_SOCKET + net_tcp_state = UCI_TCP_CONNECT_FAIL and return C=1. All three existing call sites (src/http.s:87, src/http.s:680, src/boot.s:465) already check carry — no caller updates needed.

#37 — uci_wait_idle unbounded spin

The spin-wait at src/net/uci/uci_cmd.s:69-76 had no bound, so a wedged FPGA or the phantom-socket retry loop above became a 600 s harness sentinel timeout instead of a clean error.

Fix: wall-clock-bounded via CIA1 TOD ($DC08-$DC0B) per the CLAUDE.md design note. TOD ticks at 10 Hz independent of CPU turbo, which is why a cycle-counted budget breaks at 48 MHz (cf. abandoned feat/net-drain-abi branch). Read order is HOUR (latch) → MIN → SEC → TENTHS (unlatch); state lives in two SMC bytes inside the routine to match the file's no-ZP convention. 5 s budget; on exhaustion: net_last_error = UCI_ERR_WAIT_TIMEOUT, C=1. All four callers (net_dhcp_acquire, net_tcp_connect, net_tcp_send, net_tcp_close) gained bcs bails to surface the timeout.

Labels-parser convergence

5 UCI scripts had bespoke _load_labels() doing parts[1].split(":", 1), assuming every line in build/labels.txt was al C:XXXX .name. The Makefile sed rewrites only 4-digit-with-leading-zeros addresses; raw 6-digit ld65 emissions (REU overlay symbols at 0x22100, 0x24100) survive verbatim and crash the parser. The harness's Labels.from_file() regex r"al\s+(?:C:)?([0-9a-fA-F]+)\s+\.(\S+)" handles both — adopt it as the single source of truth. phase2_check.load_label(name) preserves its custom KeyError message via an explicit guard.

Test plan

• make BACKEND=uci — clean build
• tools/uci/test_https_local.py — PASS in 79.9 s (full TLS 1.3 handshake, HTTP 200, body HELLO FROM TLS SERVER, happy-path uci_socket_id=0x07). First-ever pass for this test.
• tools/uci/test_https_print_body.py — PASS in 84.9 s (no regression on the previously-passing sibling)
• tools/uci/phase2_check.py — PASS (DHCP/IP readback)
• tools/uci/phase3_tcp_echo.py — PASS (echo roundtrip)
• tools/uci/test_http_local.py — PASS (was crashing on labels parser pre-fix)
• tools/run_all_tests.py (full VICE suite) — 264/264 PASS (verified separately; no UCI changes touch the ip65 path)

UCI suite: was 2/6 → now 6/6. VICE suite: 264/264. Both new error paths (NO_SOCKET, WAIT_TIMEOUT) verified to surface as immediate C=1 with populated net_last_error.

Risk

• The 4 uci_wait_idle callers in net.s now have new bcs bail paths that didn't exist before. Lint of those error paths in the assembly is the main review surface.
• uci_push_wait and uci_end_cmd are still unbounded — same wedge pattern would still trip there. They're left for a follow-up because no wedge has been observed there yet.