Embed IP28 PROM and use profile-specific fallback

[iblowmymind]

IP28 currently falls back to the embedded IP22 PROM when its configured ROM file is unavailable, preventing a normal IP28 boot. Embed the 512 KB 070-1477-002 image in src/prombinip28.rs and select it for the IP28 profile. The loader tries the configured path, then 070-1477-002.bin in the working directory, then the embedded IP28 image; IP22 retains its existing file precedence through the shared Indigo2 loader.

Keep the embedded PROM choice available when selecting IP28 in New Machine, remove the external-ROM requirement warnings, and update the README, changelog, configuration example, and related documentation.

Validation:

• Generated array matches the supplied binary byte-for-byte (524,288 bytes; SHA-256 a2c1cf6a8fcfe8e0bb8a82c77a0f3e4cb9b640fa995ee8a957069c993ede9246).
• cargo test --offline --locked --lib dev::prom::tests: 4 passed, including IP22/IP28 file precedence and full embedded-ROM bus reads.
• cargo check --offline --locked -p iris-gui: passed; GUI configuration controls were not smoke-tested interactively.
• Isolated diskless IP28 cold boot with two 512 MB banks and no external ROM files reached the graphical Indigo2 maintenance menu; the test shut down cleanly.
• git diff --check: passed.

A 32 MB configuration failed PROM memory diagnostics with both the embedded image and an explicit load of the same ROM file. Memory sizing behavior is unchanged by this PR.

[techomancer]

convenient