jtag: cap the clock by device max_tck_khz at autoinit (phase B)

- fpga_target gains max_tck_khz (registry key), the max safe JTAG TCK
  for a part/board (0 = unspecified)
- jtag_autoinit, after identifying the chain, resolves the clock: if the
  requested JTAG_TCK_FREQ_KHZ exceeds the smallest device max, it clamps
  it and re-opens the probe once (stored probe id) to apply, then
  re-scans; within-cap / unset just report the cap
- autoinit body extracted into autoinit_run() so it can re-run after the
  re-tune; fpga_list shows maxtck

Validated on the IGLOO2/FlashPro (req 500 -> clamp 200 -> reopen -> still
detected; within-cap and unset paths don't reopen).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -188,7 +188,12 @@ fact bounded by both the probe and the board/device.
   read directly by our Digilent driver; unset → each driver's own default
   (FTDI 1000, Digilent 4000). Set it via `set`, a `probes.yaml` profile,
   or `defaults:`. (FTDI path hardware-validated; Digilent path untested.)
-- **B** — device `max_tck_khz` + resolution after `jtag_autoinit`.
+- **B (done)** — registry `max_tck_khz` caps the clock: `jtag_autoinit`,
+  after identifying the chain, clamps `JTAG_TCK_FREQ_KHZ` to the smallest
+  device max and re-opens the probe once (via the stored probe id) to
+  apply, then re-scans. Within-cap / unset just report the cap. Effective
+  `tck = min(request, device max)`; probe-max (`min(..., probe max)`) is
+  still TODO.
 - **C** — generalise the other link settings (reset/RTCK) and wire the
   `prog` method tag into backend dispatch (ties into the SVF player).