usbd: xfer_isr drivers see an idle endpoint before their ISR callback

Follow-up from #3937 (#1292).

In dcd_event_handler, src/device/usbd.c (around line 1483 at #3937) clears BUSY|CLAIMED before calling a driver's xfer_isr. On multi-core parts, a task-side claim and re-arm of an OUT endpoint could land in that window, the same race #3937 closes for task-context completions.

Evidence: source inspection (review of #3937). The only built-in xfer_isr user is audio. It copies and re-arms inside its ISR, and tud_audio_n_read() only drains the FIFO, so no in-tree driver is affected. A custom driver with xfer_isr and task-side OUT re-arming could be.

Remaining work: decide whether to publish RX_PENDING on the ISR path too, or document that xfer_isr drivers own re-arming; add a test if the former.

Deferred because no in-tree user is affected.