bwn BCM43224 (MacBook Air A1370) driver fixes for FreeBSD 15.1

Patches + build scripts + firmware sources to make the Broadcom BCM43224
(PCI 0x14e4:0x4353, subvendor 0x106b:0x00d1) work on FreeBSD 15.1.

Fixes:
- Fix 1: compile GPL N-PHY code (BWN_GPL_PHY build wiring)
- Fix 2: NULL-guard bwn_dma_ringfree on partial attach
- Fix 3: wire bwn_update_mcast to ic->ic_update_mcast
- Fix 5: load bwn_v4_n firmware at loader stage (loader.conf)
- Fix 6: reclaim pending TX frames at bwn_dma_stop (detach double-free)
- Fix 7: driver-owned node ref + remove dr_usedslot early-return +
        bhndb_pci BHNDB_PCI_QUIRK_NO_MSI for BCM43224 (legacy INTx)
- Fix 8: restrict reclaim to TX rings only (RX reclaim caused heap
        corruption / TCP panic)

README.md  = rebuild guide (apply.sh + build.sh, manual steps)
RESEARCH.md = root-cause investigation log (Fixes 5-8)

rc.conf.backups/loader.conf.before_bwn_20260816134238

@@ -0,0 +1,5 @@
+hint.asmc.0.disabled="1"
+acpi_video_load="YES"
+acpi_ibm_load="YES"
+backlight_load="YES"
+snd_driver_load="YES"

rc.conf.backups/rc.conf.before_bwn0_primary_20260816154658

@@ -0,0 +1,12 @@
+clear_tmp_enable="YES"
+hostname="luxair"
+wlans_rtwn0="wlan0"
+ifconfig_wlan0="WPA  DHCP"
+ifconfig_wlan0_ipv6="inet6 accept_rtadv"
+sshd_enable="YES"
+ntpd_enable="YES"
+powerd_enable="YES"
+moused_enable="YES"
+# Set dumpdev to AUTO to enable crash dumps
+dumpdev="AUTO"
+kld_list="nouveau bwn_v4_n if_bwn"

rc.conf.backups/rc.conf.dup_20260816132300

@@ -0,0 +1,17 @@
+clear_tmp_enable="YES"
+hostname="luxair"
+wlans_rtwn0="wlan0"
+ifconfig_wlan0="WPA  DHCP"
+ifconfig_wlan0_ipv6="inet6 accept_rtadv"
+sshd_enable="YES"
+ntpd_enable="YES"
+powerd_enable="YES"
+moused_enable="YES"
+# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
+dumpdev="AUTO"
+
+kld_list="nouveau"
+
+# Broadcom BCM43224 (bwn) — switch primary Wi-Fi from rtwn0 USB dongle to internal bwn0
+wlans_bwn0="wlan0"
+kld_list="nouveau bwn_v4_n if_bwn"