[pwittich]

The companion cm_mcu change adds an RTC set word on the Control page (0x7f, offset 0x04), advertised by capability bit 10 (RTC_WRITE) at map minor 4. This adds MCU.set_rtc(), which writes the host's local wall-clock time as seconds since 1970-01-01 of that clock. This is not Unix time: the RTC has no time zone, so a DST change only takes effect the next time the clock is set. The client and the firmware both refuse times before 2026-01-01, and set_rtc() checks the capability bit first, so older firmware gets McuCapabilityUnavailable rather than a bare address error. The new mcu_set_rtc.py script sets the clock from the host, reads it back, and fails if the read-back is more than --tolerance seconds off (default 2). The RTC set is not serialised against the CLI time set command; MCU_REGISTER_MAP.md documents this. New unit tests cover the encoding and the gate, and new wire-contract tests check the offset, capability bit and lower bound against MCU_Reg.h. Like the other wire-contract tests, they are skipped in CI and fail locally until the cm_mcu change is merged. Tested on hardware: the RTC was set with a -1.0 s read-back offset, the CLI time agreed, and the firmware rejected pre-2026 values with invalid MCU value.