Verify HID feeder end-to-end; add smoke-test tool; update docs

The RioGamepad driver now installs and enumerates, so the user-mode
feeder path is verifiable. Add tools/RioJoySmokeTest, a standalone
on-cabinet utility that drives the real HidFeederJoystickSink (open the
device, submit reports via IOCTL_RIO_SUBMIT_REPORT) and reads the gamepad
back through winmm joyGetPosEx, asserting axes (min/mid/max), buttons,
and the POV hat all surface to the OS. Verified: all checks pass against
the installed driver.

Update docs to match reality (PLAN.md predated the HidFeederJoystickSink
commit): Phase 1 is now test-signed/installed/verified with the VHF
LowerFilters requirement noted; the stale "NullJoystickSink placeholder"
remainders in Phases 3 and 5 are corrected to reflect the wired,
verified feeder. driver/README.md notes the end-to-end verification.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

driver/README.md

@@ -29,8 +29,11 @@ Test-signed, installed, and verified on the cabinet: the devnode starts clean
 (`CM_PROB_NONE`), `vhf` attaches as a lower filter, the VHF HID child enumerates,
 and the controller registers under `VID_1209&PID_5249` in `joy.cpl`.
 
-Not yet done: wiring the real `DeviceIoControl` feeder sink (replacing the C#
-side's `NullJoystickSink`).
+The user-mode feeder (`RioJoy.Core.Output.HidFeederJoystickSink`) is wired in and
+**verified end-to-end**: driving it moves the six axes, 96 buttons, and POV hat,
+read back through `winmm joyGetPosEx` / `joy.cpl` exactly as a game would see
+them. The tray app selects it automatically when the driver is present and falls
+back to a no-op sink when it is not.
 
 ## Building