Follow-ups left open by #452 and #454 (radiotap ACK request / MT7612U retries, station core)

[josephnef]

Follow-ups the two PRs named or left open, so they are tracked somewhere other than the merged descriptions.

From #452 (radiotap ACK request + MT7612U retry limit, 8a47362)

• Port the radiotap TX_FLAGS NOACK / ACK-request choice to the Realtek TX descriptors: Jaguar1 first (BMC is unconditional there, RtlJaguarDevice.cpp), then Jaguar2/3, Kestrel and the RTL8733B, so build_stream_radiotap(mode, false) means the same thing on every backend. Today only the MT7612U reads the bit.
• examples/chanmig becomes the first in-tree no_ack=false consumer as soon as it sends any frame unicast to the peer's responder address (everything it builds today is a broadcast probe request, so NOACK is correct there).
• The ~20 ms per-frame cost of one-way unicast injection on the MT7612U is not the retry ladder (0 retries measured off MT_TX_STAT_FIFO) and is still unexplained; candidates not yet separated: per-WCID serialization with the 0xff no-station index, TXOP/EDCA admission for a unicast RA, lazy USB completion. docs/mt7612u-tx-retry.md "The open question".
• The one-step TX-status lag in mt7612uprobe txs (status visible only after the next submit vs an EXT/FIFO pairing off by one) is characterised but not explained.
• Nit: txs_parse_long in src/mt7612u/tools/bringup.cpp carries a stale duplicate comment block above it (the first one describes txs_retry_limit_env).
• The NOACK-vs-ACK delivery table (0/5386 lost with ACKs requested) came from an associated-client harness + AP-side ledger that are not in the tree; make it reproducible once a station consumer lands.

From #454 (device-free station core, 956e723)

• A consumer: nothing in the tree drives StationSm against a radio yet. DupDetector and msdu_to_eth/eth_to_msdu have no in-tree caller either, and the data-plane caller must run one duplicate cache per transmitter itself.
• AP-side multi-station table (per-station PTK, TX PN, replay state), deliberately left out.
• CcmpReplay window is 64 PNs (HT/VHT BlockAck); must be widened before any HE/EHT peer negotiating 256/1024.
• The IEEE 802.11-2016 Annex J.4 CCMP vector is still not in the tree (copy from the standard or hostapd's wlantest vectors, never from memory); the kernel captures are an interop reference, not the spec.
• No captured hostapd group rekey; that path is pinned only by the same-author fixture.
• PMF / 802.11w: an MFP-required BSS is not selected and deauth/disassoc are accepted unauthenticated.
• A forged message 1 replaces the single in-flight candidate PTK (same exposure as wpa_supplicant's TPTK); during a PTK rekey on an established link it can cost the link.