docs: correct wrong Fire2 header traps in heat2.py + fifa-blaze frame.rs

Both files documented a wrong Fire2 header layout as authoritative, the reader
trap called out in Known Issues:
- heat2.py's module docstring labelled its >IHHHHB3s header 'VALIDATED'. The
  round-trip only validates the payload length + TDF body; decode->encode with the
  same mislabelled header trivially reproduces the capture, so it never tested the
  [10:16] field boundaries. Marked superseded; cite the proven layout; warn at
  build_fire2_frame. Code unchanged (dead tooling).
- fifa-blaze frame.rs: see submodule commit f4f3396.

Bumps fifa-blaze submodule eccd46f -> f4f3396 (FIFA23 stub; not in the prod
container; no prod impact).

fifa17-recon/tools/heat2.py

@@ -15,16 +15,27 @@ reimplementations (the `tdf` crate cloned in this scratchpad), which were used
 only as a cross-check of *structure*, never copied.
 NO EA/FIFA leaked source was consulted.
 
-VALIDATED RULES (byte-exact round-trip against the 219-byte capture)
---------------------------------------------------------------------
-Fire2 frame header, 16 bytes big-endian:
-    [0:4]  u32 payload length (bytes after the header)
-    [4:6]  u16 always 0 (observed)
-    [6:8]  u16 component
-    [8:10] u16 command
-    [10:12]u16 error / msgId
-    [12]   u8  msgType   (0x01 ping, 0x02 request, 0x03 pong/response)
-    [13:16]3 reserved bytes (observed 00 00 00)
+VALIDATED RULES (the TDF body; byte-exact round-trip against the 219-byte capture)
+---------------------------------------------------------------------------------
+Fire2 frame header, 16 bytes big-endian.
+
+    !!! SUPERSEDED — the [10:16] FIELD SEMANTICS below are WRONG for FIFA 17. !!!
+    The "byte-exact round-trip" only proves the payload length and the TDF body
+    encoding: decoding then re-encoding with the SAME (mis)labelled header layout
+    trivially reproduces the capture, so it never tested the header's field
+    boundaries. The authoritative, live-driven layout is
+    `openfut-protocol-blaze::fire2` / `blaze_responder_v3b.py::fire2`:
+        [0:4]   u32 payload length (bytes after header + metadata)
+        [4:6]   u16 metadata length (0 when absent — what this file called "always 0")
+        [6:8]   u16 component
+        [8:10]  u16 command
+        [10:13] u24 msgNum          (this file WRONGLY split it as [10:12] msgId + [12] msgType)
+        [13]    u8  (msgType << 5) | (userIndex & 0x1F)
+        [14]    u8  options
+        [15]    u8  reserved
+    There is NO error field in Fire2 (that is Fire v1) and NO jumbo escape — the
+    length is already a full u32. `build_fire2_frame`/`decode_fire2` below keep the
+    old wrong `>IHHHHB3s` layout; they are dead and retained only for history.
 
 Heat2 field = 3-byte packed tag + 1 type byte + value.
 
@@ -359,7 +370,14 @@ MSG_ERROR = 0x05     # UNVERIFIED
 
 def build_fire2_frame(component: int, command: int, msgType: int,
                       msgId: int, tdf_bytes: bytes) -> bytes:
-    """16-byte big-endian Fire2 header + TDF payload."""
+    """16-byte big-endian Fire2 header + TDF payload.
+
+    WRONG HEADER (dead code): the ``>IHHHHB3s`` layout mislabels [10:16] — it
+    puts a u16 msgId at [10:12] and msgType at [12]. FIFA 17's real Fire2 header
+    is [10:13] u24 msgNum, [13] (msgType<<5)|userIndex, [14] options, [15]
+    reserved, and has no error field. Use ``openfut-protocol-blaze::fire2`` or
+    ``blaze_responder_v3b.py::fire2``; this is retained only for history.
+    """
     tdf_bytes = bytes(tdf_bytes)
     hdr = struct.pack(">IHHHHB3s", len(tdf_bytes), 0, component & 0xFFFF,
                       command & 0xFFFF, msgId & 0xFFFF, msgType & 0xFF,