Self-ping CSI source (#521/#954) yields only ~2–9 CSI/s when the AP answers ICMP at 802.11b rates #2287

Summary

The 50 Hz gateway self-ping is meant to guarantee an OFDM unicast CSI floor.
On our router the echo replies do arrive (~50/s, <1% timeouts), but about
98% of them are sent at 802.11b DSSS/CCK rates, which produce no CSI. Raw CSI
stays at 2–9 frames/s, the adaptive controller sits in ADAPT_STATE_DEGRADED,
and the node never reaches the ≥20 pps the pipeline expects. Ordinary unicast
UDP to the node, from the same router, goes out as HT and gives ~42 CSI/s.

Environment

• Firmware: v0.8.8-esp32 (e04f269), ESP-IDF v5.4, ESP32-S3-WROOM-1 N16R8,
  display-less build (MGMT+DATA promiscuous upgrade active, WIFI_PS_NONE).
• Same self-ping code on main at a1ca023.
• AP: Cudy WiFi 6 router (MediaTek), 2.4 GHz channel 1. Setting the AP to
  20 MHz made no difference. The AP offers no 11b-disable or rate options.

Evidence (MEASURED)

Diagnostic build with counters (10 s window, from the boot log):

diag: ping ok=1468 timeout=32 | csi raw_cb=358 early_drop=249 cb=109 sent=109
diag: data-to-me 11b=1383 ofdm=0 ht=31

data-to-me counts DATA frames whose addr1 is the station MAC in the
promiscuous callback, by rx_ctrl.sig_mode / rx_ctrl.rate (rate < 8 with
sig_mode == 0 = 11b).

Things that did not help:

• esp_wifi_config_11b_rate(WIFI_IF_STA, true) (disabling the node's own 11b
  TX): 11b=1385 ht=32, unchanged.
• Capping the esp_ping reply timeout at one interval (the IDF default is
  1000 ms, which stalls the loop on each lost reply). Worth doing anyway, but
  replies weren't the bottleneck here.
• PC → node ICMP at 20 Hz: no CSI increase (the AP forwards ICMP at 11b too).

What does help: unicast UDP from a LAN host to the node at 50 Hz → raw
CSI 42.4/s (HT20, almost all STBC). It looks like the AP sends small ICMP
frames at the lowest basic rate, as some MediaTek drivers do for
"control-type" traffic.

Suggestions

1. Use UDP instead of ICMP for the built-in traffic source. For example, a
   small UDP request to a service on the gateway that answers (DNS on :53 is
   the common one), or an optional host-side "poke" that the sensing server
   sends to each node it knows about.
2. Document the symptom: when yield stays low despite self-ping, check
   rx_ctrl.sig_mode/rate of the replies; 11b replies can never produce
   CSI.
3. Set cfg.timeout_ms to the ping interval, so one lost reply doesn't stall
   the 50 Hz loop for a second.

Related: #521, #954.