Fix CYW43439 payload offsets

[sqt]

Motivation

Payload access depends on the reader’s current position, so reading control data before its header returns incorrect bytes.

Description of changes

• Calculate payload slices from packet-relative offsets instead of the reader cursor.
• Add regressions for control payload access before and after header decoding, plus padded WiFi event decoding.