usb: the controller says how many device slots it has

max_devices was 8, with the comment "QEMU presents a handful; a fuller
machine would grow this" — a number chosen against the test rig, waiting for
a real machine, which is the pattern docs/bounds-track-plan.md exists to
stop.

The driver already knew the true figure. It reads HCSPARAMS1.MaxSlots at
bring-up and writes it straight into op_config, so every slot the controller
offers has always been *enabled*; only the array tracking them was 8. QEMU's
xHCI reports 64, so seven eighths of the controller was live and invisible,
and the ninth device — a keyboard, mouse, webcam, headset, hub and two
sticks reach that without trying — disappeared on a hub-attached path that
logs nothing at all.

The array becomes a slice allocated from max_slots at bring-up. A controller
claiming zero slots cannot address anything, so that is now a dead
controller rather than an empty allocation failing mysteriously later. The
Device Context Base Address Array is a page, 511 usable entries, so it
already covered the 255-slot maximum.

The bring-up line reports both numbers, and usb-hid asserts they are equal
with a backreference rather than a magic number, so the test cannot drift
from the hardware. Pinning tracking back to 8 fails it: "64 slots,
tracking 8".

Suite 115/115.

system/drivers/usb-xhci-bus/usb-xhci-bus.zig

@@ -228,8 +228,13 @@ fn initialise(endpoint: ipc.Handle) bool {
         _ = logging.write("/system/drivers/usb-xhci-bus: controller reset/bring-up failed\n");
         return false;
     };
-    std.log.info("controller running ({d} slots, {d}-byte contexts)", .{
+    // Both numbers, because for a long time they disagreed silently: the controller
+    // reported its real slot count and the driver tracked a fixed 8 of them, so a
+    // ninth device — trivially reachable behind a hub — simply did not exist. They
+    // must now be equal, and the suite asserts it.
+    std.log.info("controller running ({d} slots, tracking {d}, {d}-byte contexts)", .{
         controller.?.max_slots,
+        controller.?.devices.len,
         controller.?.context_size,
     });
     // The proof of life: a No-Op command round-trips the command ring, the event