fix(rf): true single-edge P3.6 trigger + pull-down, restore edge decode

Root cause found via datasheet: PxIM0/PxIM1 has no dual-edge mode, only
falling/rising/low-level/high-level. (IM1=1,IM0=1) was actually
high-level interrupt, refiring continuously for the whole high-pulse
duration (confirmed by scope: no real HF noise, and edge_count=0 when
P3.6 grounded). Fix: start in rising-edge mode, software-toggle to the
opposite edge on every trigger (ping-pong) to emulate true dual-edge
triggering, feeding exact edge direction into the incremental decode
state machine (no glitch filter needed). Also switch P3.6 idle bias
from pull-up to pull-down, since floating-high under the old high-level
mode caused the interrupt-storm boot issue; removed the now-conflicting
pull-up restore in Wakeup_Restore().

App/system.c

@@ -390,9 +390,8 @@ void Wakeup_Restore(void)
     P0INTE = 0x00;
     P2INTE = 0x00;
     P3INTE = 0x40;
-    // 恢复休眠前被 Enter_Low_Power_Sleep() 关闭的 P3.6 内部上拉：LR690L 在 SHUT=1 期间数据脚
-    // 高阻悬空，配合常态开启的 P3.6 中断会引发中断风暴，唤醒后必须立刻用上拉钳住电平
-    P3PU |= 0x40;
+    // P3.6 的悬空钳位已改用内部下拉 (P3PD，在 RF_Init() 里一次性永久开启，Power Down 期间
+    // SFR 状态保持不变，无需在这里重新配置)；此处不再恢复上拉，避免上拉与下拉同时使能相互打架
 
     P0WKUE = 0x00;
     P2WKUE = 0x00;