Two fixes for the frame sync timing bug reported by uart-agent:
1. CFO Overwritten by Timing Refinement
- The _refine_symbol_boundary() returns a bin that reflects timing
offset, not CFO. For aligned loopback signals, any timing shift k
produces bin=k, incorrectly interpreted as CFO.
- Fix: Keep CFO from state machine instead of overwriting.
2. SFD Correlation Noise Issues
- For perfectly aligned signals, skip SFD correlation and use known
frame structure offset (preamble_count + 4.25 symbols).
- For real captures, use SFD correlation with adjusted search start.
Also updates SFD search start from (preamble_count + 1) to
(preamble_count + 3) for real captures to match existing decoder.
Loopback test: 50/50 seeds pass (100%)
Real SDR capture: All 10 bins match existing decoder
