USB-1->CV routing patch: mirror cable-0 events into the CV ring

The stock CV_Out_Source only offers Expander / USB-3, so MIDI arriving on
USB port 1 (Control Surface, cable 0) never reaches the CV engine. This
patch retargets the single USB-MIDI dispatch call at 0xDF28 from the
stock cable-number router (0xA57B) to a 23-byte stub written into the 0xFF
padding at 0x8126.

The stub runs the original router unchanged, then inspects the 4-byte
USB-MIDI event buffer at 0x0F9B: if the event came in on cable 0 (top
nibble == 0) it retags it as cable 2 (sets bit 0x20) and calls the router
again, so the event also lands in the USB-3 / CV ring. Events on any other
cable pass through untouched (one router call, as stock).

  0x8126:  23x 0xFF padding  ->  usb1_cv_stub (lcall/mov/movx/.../ret)
  0xDF28:  lcall 0xa57b       ->  lcall L_8126   (-> usb1_cv_stub)

Assembles byte-identical to the patched image (stock + stub + retarget),
matching what patch_c2.py writes to the device over C2. Verified with
`python3 roundtrip.py --patch` (PASS, 3 iterations).

Stock source is regenerable with:  python3 roundtrip.py

firmware.asm

@@ -14034,29 +14034,20 @@ movx @r0, a
 jc L_817D
 rr a
 xch a, r5
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
-mov r7, a
+L_8126:
+lcall 0xa57b
+mov dptr, #0x0f9b
+movx a, @dptr
+anl a, #0xf0
+jnz L_813C
+movx a, @dptr
+orl a, #0x20
+movx @dptr, a
+mov r6, #0x0f
+mov r7, #0x9b
+lcall 0xa57b
+L_813C:
+ret
 mov r7, a
 mov r7, a
 .db 0x41, 0x03
@@ -28378,7 +28369,7 @@ sjmp L_DF34
 L_DF24:
 mov r6, #0x0f
 mov r7, #0x9b
-lcall 0xa57b
+lcall L_8126
 mov a, r7
 jz L_DF32
 mov r7, #0x01