dwt: correct the Done\n reply length (payload includes its NUL, len field = payload+1)

dwt/notes/CROSS.md

@@ -61,7 +61,10 @@ Facts that change the transport assumption (details + quotes in
 2. **Wire format is binary, not text.** Request = `u32 be opcode` + opcode
    arguments (each word big-endian). Response framing =
    `u32 be (payload_len+1)` + `u8 flag` + payload. Opcode 7 is a no-op that
-   answers `00 00 00 07 00 "Done\n"` — the cheapest liveness test.
+   answers 11 bytes: `00 00 00 07 | 00 | 44 6F 6E 65 0A 00` (len field = 7 =
+   payload 6 + flag 1; payload is `"Done\n"` **plus its NUL**, because the
+   handler passes the 6-byte C string at `0x07EB6CE9`). The cheapest liveness
+   test.
 3. **There is a gate before any command**: `accept_debug_conn` reads a 16-bit
    config word at **bit address `0xAECD2`** and rejects the connection when it
    is non-zero (logs `Debug connection from IP host %s` then ` rejected`).