pbhw: --one-wire never reached the suite's own sessions

The flag was plumbed through pbrig.Deployment to the host-tool subprocess
calls and nowhere else, so identity() and scan() opened a raw port and drove
a shared line as though it were two wires. On real one-wire hardware the
adapter's echo answers the knock before the device does, so the suite would
have died at its very first check — "the loader never answered; nothing below
can be trusted" — for the one deployment the flag exists to test, and every
result after it is gated on that check passing.

Both now open through pbrig.Rig.open_port(), which applies the deployment's
link mode. The gap underneath was that only the subprocess path could reach
those facts at all; anything driving the protocol in-process had to restate
them, and did not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/pbrig.py

@@ -281,6 +281,22 @@ class Rig:
             return 99, f"TIMEOUT after {timeout}s\n{expired.stdout or ''}{expired.stderr or ''}"
         return result.returncode, (result.stdout or "") + (result.stderr or "")
 
+    def open_port(self, baud: int | None = None):
+        """A port opened the way this deployment says to speak to the board.
+
+        Everything the rig runs as a *subprocess* gets its flags from
+        `pureboot()` above; anything that drives the protocol in-process has
+        to reach the same facts, and until this existed only the subprocess
+        path could. A shared line is the one where that gap is fatal rather
+        than untidy: the host reads back every byte it writes, so an
+        undiscarded echo answers the knock before the device does. Open
+        through here and a one-wire deployment cannot be silently driven as
+        a two-wire one.
+        """
+        module = load_pureboot(self.d.pureboot)
+        port = module.Port(self.d.port, self.d.baud if baud is None else baud)
+        return module.OneWirePort(port) if self.d.one_wire else port
+
     def capture(self, seconds: float = 2.0, baud: int | None = None) -> bytes:
         """Listen to whatever the board is saying, at an arbitrary rate.