usb: hub-downstream disconnect teardown + hub-behind-hub recursion (B4c)

Completes hub support (docs/usb-hub.md). On the bus tick, a downstream
hub-port change now dispatches: a connect enumerates the new device
(B4b), a disconnect tears the old one down — recursively, since a hub
that leaves takes its whole subtree with it (children first), reporting
each interface ChildRemoved and Disable-Slotting the device. Route
strings compose across tiers, so a device two hubs deep enumerates with
a two-tier route.

QEMU's hub — unlike root-port hot-plug — DOES raise downstream
status-change events, so both paths are harness-tested: usb-hub (a
keyboard behind a hub binds usb-hid-keyboard), usb-hub-nested (a
keyboard two hubs deep), usb-hub-unplug (device_del behind the hub tears
it down). Full suite 91/91.

Real-hardware validation of the user's SuperSpeed Genesys hub with
full-speed devices on its USB2 companion is flagged for the user (QEMU's
USB2 hub does not model the compound USB3 hub).

docs/usb-hub.md

@@ -92,12 +92,20 @@ Real-hardware validation (the user's SuperSpeed Genesys hub + full-speed
 keyboard/mouse on its USB 2.0 companion) is flagged separately — the compound
 USB 3.0 hub path is not modelled by QEMU's USB 2.0 hub.
 
-## Milestones
+## Milestones (all complete)
 
-- **B4a** — hub recognition + setup: detect class 9 in the scan, read the hub
-  descriptor, mark the slot a hub, power downstream ports, arm the status-change
-  endpoint, log the topology. No downstream enumeration yet.
-- **B4b** — downstream enumeration: status-change handling, port reset,
-  `setupDevice` with route string + root port + TT fields, enumerate + register.
-  A full-speed device behind the hub reaches its class driver.
-- **B4c** — disconnect teardown + hub-behind-hub recursion + polish.
+- **B4a** ✓ — hub recognition + setup: detect class 9 in the scan, read the hub
+  descriptor, configure the slot as a hub, power downstream ports, log the
+  topology.
+- **B4b** ✓ — downstream enumeration: the in-process status-change subscription,
+  port reset, Address Device with route string + root port + TT fields,
+  enumerate + register. A full-speed keyboard behind a USB2 hub binds
+  `usb-hid-keyboard` in QEMU.
+- **B4c** ✓ — disconnect teardown (recursive: a hub takes its subtree with it)
+  and hub-behind-hub recursion (route strings compose across tiers). QEMU's hub
+  *does* raise downstream status changes, so both connect and disconnect are
+  harness-tested (`usb-hub`, `usb-hub-nested`, `usb-hub-unplug`).
+
+Real-hardware validation of the user's SuperSpeed Genesys hub with full-speed
+devices on its USB 2.0 companion remains pending — QEMU's USB 2.0 hub does not
+model the compound USB 3.0 hub.