feat: S11 - explicit VCU stop command on 0x212 byte 3 (replaces udclim hack)

The -S10 udclim=200V mechanism was a hack — VCU lowered udclim below
pack to fire CheckVoltage() udc>udclim and force STOP. It didn't work
reliably because once VCU opens HV contactors, the OBC per-module
voltage probes (c1udc/c2udc/c3udc) collapse below 200V and udc =
MAX(c1,c2,c3) never accumulates 10 ticks above udclim. Bench symptom:
VCU reaches CHARGE_COMPLETE, opens contactors, but teslacharger stays
in EVSEACTIVATE, OBC modules keep drawing ~0.5kW AC, water pumps run,
CP signal stays charging, EVSE doesn't shut down.

S11 adds an explicit vcustop byte on 0x212 byte 3 — VCU sets it to 1
when it wants charging stopped. ChargerStateMachine checks vcustop
FIRST in the EVSEACTIVATE case and transitions to STOP immediately.
Mirrors how the Dilong OBC obeys OBC_ControlCMD = Stopped.

Wire format (additive, no breaking change to S10):
  Byte 0:    vcuchglim_pct  (existing)
  Bytes 1-2: udclim_V       (existing, DEPRECATED — VCU sends 398V no-op)
  Byte 3:    vcustop        (NEW, 0=normal / 1=force stop)
  Bytes 4-7: reserved

Defensive: Param::Change(udclim) now clamps received <50V values to the
398V flash default. Protects against a pre-PR47 VCU sending all-zeros
in bytes 1-2 (which would otherwise make CheckVoltage() fire constantly
and brick charging).

After this VCU also flashed: the WPUMP issue resolves naturally because
VCU_IsCharging() reads OIOBC.State < ACTIVATE once teslacharger goes
to STOP. The VCU/teslacharger ownership becomes symmetric with the
Dilong path — VCU is authoritative for "should we charge."

Pool: 43 → 44 / 50 slots used.

#patch

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

include/param_prj.h

@@ -47,7 +47,7 @@
    3. Display values
  */
 //Next param id (increase when adding new parameter!): 24
-//Next value Id: 2052
+//Next value Id: 2053
 /*              category     name         unit       min     max     default id */
 #define PARAM_LIST \
     PARAM_ENTRY(CAT_CHARGER, idclim,      "A",       0,      45,     45,     3   ) \
@@ -109,6 +109,7 @@
     VALUE_ENTRY(c3udc,       "V",     2035 ) \
     VALUE_ENTRY(c3idc,       "A",     2036 ) \
     VALUE_ENTRY(tmpobcmax,   "°C",    2051 ) \
+    VALUE_ENTRY(vcustop,     OFFON,   2052 ) \
     VALUE_ENTRY(test_time,   "s",     3000 ) \
     VALUE_ENTRY(test_timer_flag,   "X",     3001 ) \
     VALUE_ENTRY(test_timer_icvalue,   "X",     3002 ) \
@@ -139,12 +140,18 @@
 // -S9 restores 8 c2/c3 RX entries (uac/flag/idc/udc per module). -S8 over-
 // trimmed multi-module Tesla OBC support: CalcTotals was summing only
 // module 1's contribution, so reported pack power was 1/3 of actual delivery.
-// -S10 adds udclim RX on 0x212 bytes 1-2. With this, the VCU can force a
-// hard stop by sending udclim=200V (below pack), which fires the existing
-// ChargerStateMachine CheckVoltage() exit (udc > udclim → STOP). Closes the
-// gap where Fix B's contactor-open left the OBC modules drawing ~0.55 kW AC
-// indefinitely because EVSEACTIVATE had no other exit path.
-#define VERSTR STRINGIFY(4=VER-S10)
+// -S10 added udclim RX on 0x212 bytes 1-2. The VCU sent udclim=200V to force
+// CheckVoltage() to fire (udc > udclim → STOP). DEPRECATED in -S11: the
+// per-module DC voltage readings (c1udc/c2udc/c3udc) collapse below 200V
+// once VCU opens HV contactors, so the trigger never accumulates 10 ticks.
+// udclim RX is kept mapped but the VCU now always sends 398V (no-op).
+//
+// -S11 adds vcustop RX on 0x212 byte 3 — an explicit VCU command lever that
+// mirrors the Dilong path's OBC_ControlCMD. When VCU enters CHARGE_COMPLETE
+// it sets vcustop=1; ChargerStateMachine's EVSEACTIVATE case transitions to
+// STOP immediately, the J1772 CP signal drops, EVSE stops delivering AC,
+// VCU_IsCharging() returns 0, water pumps power down naturally.
+#define VERSTR STRINGIFY(4=VER-S11)
 
 /***** enums ******/