pandad: protect app firmware from recover, keep blank-board flashing

The SPI panda boot loop called recover_internal_panda() whenever the panda
did not appear within 20s after a reset. recover() erases both the bootstub
and app sectors (dfu.py program_bootstub erases sectors 0+1) before
reflashing, so a working panda that booted slowly lost its app firmware.

Fix:
- pandad.py: wait up to 60s for the panda, retry the normal reset 3x, and
  only enter the ROM bootloader (recover) when the panda is confirmed in DFU
  or all normal resets failed - preserving provisioning of blank boards.
- hardware.py: align recover_internal_panda() timing with the working manual
  flash scripts (0.2s reset hold, 1s settle, keep BOOT0 high).
- spi.py: raise the SPI bootloader ack timeout from 0.01s to 0.1s so the DFU
  flash reliably succeeds instead of erasing then failing.

openpilot/common/hardware/comma/hardware.py

@@ -410,10 +410,11 @@ class HardwareComma(HardwareBase):
 
     gpio_set(GPIO.STM_RST_N, True)
     gpio_set(GPIO.STM_BOOT0, True)
-    time.sleep(0.01)
+    time.sleep(0.2)
     gpio_set(GPIO.STM_RST_N, False)
-    time.sleep(0.01)
+    time.sleep(1)
-    gpio_set(GPIO.STM_BOOT0, False)
+    # Keep BOOT0 high while the SPI ROM bootloader session runs; the custom
+    # SPI panda needs it held (matches the manual flash scripts).
 
   def booted(self):
     # this normally boots within 8s, but on rare occasions takes 30+s

openpilot/selfdrive/pandad/pandad.py

@@ -101,17 +101,16 @@ def main() -> None:
     cloudlog.exception("pandad.uncaught_exception")
 
   count = 0
+  recover_attempts = 0
   while not do_exit:
     try:
       cloudlog.event("pandad.flash_and_connect", count=count)
       HARDWARE.reset_internal_panda()
       count += 1
-      # The internal SPI panda takes ~10s to boot its app after a reset.
+      # The internal SPI panda can take a while (up to ~60s on occasion) to
-      # Wait for it to come back in normal (non-bootstub) mode before
+      # boot its app after a reset, so wait generously.
-      # deciding whether to flash. Only fall back to the bootloader
-      # (recover) path if it never appears.
       panda_serials: list[str] = []
-      for _ in range(40):
+      for _ in range(120):
         panda_serials = Panda.list()
         if panda_serials:
           try:
@@ -122,9 +121,17 @@ def main() -> None:
             pass
         time.sleep(0.5)
       if not panda_serials:
-        cloudlog.info("Panda did not appear after reset, trying recover...")
+        # Never force a board that already has firmware into the ROM bootloader
+        # right away: recover erases the app sector before reflashing. Only a
+        # truly blank board needs it, and that is detected after several normal
+        # resets fail to produce a panda at all.
+        if not PandaDFU.list() and recover_attempts < 3:
+          recover_attempts += 1
+          cloudlog.warning(f"Panda did not appear after reset ({recover_attempts}/3), retrying normal reset...")
+          continue
+        cloudlog.info("Panda missing after normal resets, entering ROM bootloader (recover)...")
         HARDWARE.recover_internal_panda()
-        time.sleep(5)
+        time.sleep(2)
 
       # Flash all Pandas in DFU mode
       for serial in PandaDFU.list():

panda/python/spi.py

@@ -328,7 +328,7 @@ class STBootloaderSPIHandle(BaseSTBootloaderHandle):
       # sync + command
       spi.xfer([self.SYNC, ])
       spi.xfer([cmd, cmd ^ 0xFF])
-      self._get_ack(spi, timeout=0.01)
+      self._get_ack(spi, timeout=0.1)
 
       # "predata" - for commands that send the first data without a checksum
       if predata is not None: