Fix variant B firmware upload: MODE SELECT not WRITE_BUFFER

B firmware upload () byte-level verification reveals:
- Step 1: MODE SELECT (0x55), NOT WRITE_BUFFER — sends 2496 bytes (0x9C0)
- Step 2: Check result == 2
- Step 3: READ_BUFFER mode=6 offset=0x3000 (16B firmware metadata)
- Step 4: WRITE_BUFFER mode=6 (16B from fw_write_data)
- Step 5: Vendor verify CDB (0xF1 opcode from blob)
- Step 6: do_unlock × 5 retries + 1 confirmation

Key differences from A:
- A uses WRITE_BUFFER (0x3B), B uses MODE SELECT (0x55)
- A sends 1888 bytes, B sends 2496 bytes
- B has extra READ metadata + WRITE 16B + vendor verify steps
- B retries unlock 5 times (A does 2)

Added profile fields: fw_write_data (16B), verify_cdb (10B) for B-only.

src/profile.rs

@@ -78,6 +78,16 @@ pub struct DriveProfile {
     pub hardware_register_b_cdb: Vec<u8>,
 
 
+    /// 16 bytes written via WRITE_BUFFER mode=6 during B firmware upload.
+    #[serde(default, deserialize_with = "deserialize_hex_vec")]
+    pub fw_write_data: Vec<u8>,
+
+    /// Vendor-specific verify CDB after B firmware upload (10 bytes).
+    /// B-only. Empty for A-variant drives.
+    #[serde(default, deserialize_with = "deserialize_hex_vec")]
+    pub verify_cdb: Vec<u8>,
+
+
     /// Pre-built SET_CD_SPEED CDB with drive's nominal speed (12 bytes).
     /// Used in calibration "triple play": max → this → max.
     #[serde(default, deserialize_with = "deserialize_hex_vec")]