feat: S11 - explicit VCU stop command on 0x212 byte 3 (replaces udclim hack)

The -S10 udclim=200V mechanism was a hack — VCU lowered udclim below
pack to fire CheckVoltage() udc>udclim and force STOP. It didn't work
reliably because once VCU opens HV contactors, the OBC per-module
voltage probes (c1udc/c2udc/c3udc) collapse below 200V and udc =
MAX(c1,c2,c3) never accumulates 10 ticks above udclim. Bench symptom:
VCU reaches CHARGE_COMPLETE, opens contactors, but teslacharger stays
in EVSEACTIVATE, OBC modules keep drawing ~0.5kW AC, water pumps run,
CP signal stays charging, EVSE doesn't shut down.

S11 adds an explicit vcustop byte on 0x212 byte 3 — VCU sets it to 1
when it wants charging stopped. ChargerStateMachine checks vcustop
FIRST in the EVSEACTIVATE case and transitions to STOP immediately.
Mirrors how the Dilong OBC obeys OBC_ControlCMD = Stopped.

Wire format (additive, no breaking change to S10):
  Byte 0:    vcuchglim_pct  (existing)
  Bytes 1-2: udclim_V       (existing, DEPRECATED — VCU sends 398V no-op)
  Byte 3:    vcustop        (NEW, 0=normal / 1=force stop)
  Bytes 4-7: reserved

Defensive: Param::Change(udclim) now clamps received <50V values to the
398V flash default. Protects against a pre-PR47 VCU sending all-zeros
in bytes 1-2 (which would otherwise make CheckVoltage() fire constantly
and brick charging).

After this VCU also flashed: the WPUMP issue resolves naturally because
VCU_IsCharging() reads OIOBC.State < ACTIVATE once teslacharger goes
to STOP. The VCU/teslacharger ownership becomes symmetric with the
Dilong path — VCU is authoritative for "should we charge."

Pool: 43 → 44 / 50 slots used.

#patch

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/charger.cpp

@@ -353,15 +353,28 @@ void ChargerStateMachine()
          DigIo::evseact_out.Set();
          DigIo::acpres_out.Set();
 
-         if (CheckVoltage() || CheckTimeout())
+         // SKUDAK-S11: explicit VCU stop command takes priority over every
+         // other exit condition. When the VCU's BMS-side gate determines the
+         // charge session is complete (or the user lowered ChargeLimit below
+         // current SOC), it sets vcustop=1 on 0x212 byte 3. We obey
+         // immediately — drop AC pres + EVSE-active GPIOs and transition to
+         // STOP. Mirrors how the Dilong path's OBC_ControlCMD = Stopped works.
+         // Replaces the brittle udclim=200V mechanism from -S10.
+         if (Param::GetInt(Param::vcustop))
+         {
+            DigIo::acpres_out.Clear();
+            DigIo::evseact_out.Clear();
             state = STOP;
-         if (CheckUnplugged())
+         }
+         else if (CheckVoltage() || CheckTimeout())
+            state = STOP;
+         else if (CheckUnplugged())
          {
             DigIo::acpres_out.Clear();
             DigIo::evseact_out.Clear();
             state = OFF;
          }
-         if (CheckChargerFaults())
+         else if (CheckChargerFaults())
          {
             DigIo::acpres_out.Clear();
             state = OFF;