benchmark: AI-Ghidra landscape + case-4 harness (synthetic PHY)

- benchmark/ai_ghidra/SETUP.md documents the GhidrAssist 1.5.0 install
  at /opt/ghidra/Ghidra/Extensions/GhidrAssist/ on oppenheimer (CT131),
  with dirac endpoints (Hermes-2-Pro 8B @ :8080, Qwen-coder 1.5B @ :8081)
  already reachable + tested. Final enable+config is UI-only; two
  clicks on next Ghidra launch.
- gdb_debug/harness.c extended with case 4 = train_phy_block running
  under a synthetic PHY at 0x40000000. Static MMIO shim satisfies
  polls 1-3; poll 4 needs dynamic state-machine (next session, via
  SIGBUS handler or ptrace) — documented in the README.

Vendor tree investigation: Rockchip's own sdram_rk3588.c / sdram_rk3568.c
are STUBS (return -1). No free function names from there. Path forward:
mine the vendor kernel's rockchip_dmc.c (devfreq DDR scaling driver)
for register-offset naming hints at runtime-call level.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

benchmark/gdb_debug/Makefile

@@ -18,8 +18,9 @@ endef
 $(eval $(call WRAP_BIN,func_01,01_memset))
 $(eval $(call WRAP_BIN,func_02,02_memcpy32))
 $(eval $(call WRAP_BIN,func_03,03_magic_memset))
+$(eval $(call WRAP_BIN,func_04,04_train_phy_block))
 
-gdb_debug.elf: harness.c func_01.o func_02.o func_03.o
+gdb_debug.elf: harness.c func_01.o func_02.o func_03.o func_04.o
 	gcc -O0 -g -Wall -o $@ $^
 
 clean: