dwt: correct the Done\n reply length (payload includes its NUL, len field = payload+1)

dwt/notes/rdebug-static.md

@@ -508,7 +508,8 @@ No allow-list and no confirmation dialog were found on this path.
    required; without it there is nothing to connect to).
 4. Connect to TCP port **771** and send `u32 be 7` (`0x00000007`) — opcode 7 is
    the no-op. A correct reply proves the accept path and framing:
-   `00 00 00 07 00 'D' 'o' 'n' 'e' '\n'`.
+   `00 00 00 07 | 00 | 44 6F 6E 65 0A 00` (11 bytes; the 6-byte payload
+   includes the NUL of `"Done\n"` and the length field counts payload+flag).
 5. If the handshake fires (`dwt_prf`) and replies with 16 bytes, capture them
    and try echoing them back; if the session survives, send
    `u32 be 2` + `u32 be <addr*8>` + `u32 be 4` and check for 4 bytes of ROM