Bluetooth: Controller: Align PAST sync_offset_us calc with CIS_IND

[Copilot]

ull_sync_setup_from_sync_transfer() adjusted sync_offset_us from the received LL_PERIODIC_SYNC_IND PDU using a signed int16_t narrowing of an unsigned subtraction, and didn't cleanly cover the case where the PDU's Connection Event Counter refers to a connection event already in the past relative to the current CE at processing time on the peripheral.

Changes

• ull_sync.c — ull_sync_setup_from_sync_transfer(): adopt the CIS_IND LLCP instant_latency idiom for the CE delta.
  • Parameter: int16_t conn_evt_offset → uint16_t conn_evt_latency, computed unsigned/wrap-safe as (current − reference) & 0xFFFF, mirroring rp_cc_check_instant_by_counter() / lp_cc_check_instant() in ull_llcp_cc.c.
  • Dispatch on conn_evt_latency <= 0x7FFFU:
    • Past reference CE (0..0x7FFF): subtract conn_evt_latency * conn_interval_us from sync_offset_us; if that drives the anchor into the past, advance lll->event_counter by the required whole number of PA intervals and set sync_offset_us to the remainder.
    • Future reference CE (0x8000..0xFFFF): add (0x10000 − conn_evt_latency) * conn_interval_us.
• ull_sync_transfer_received(): pass (conn_evt_current − conn_event_count) & 0xFFFFU to match.

Illustration

/* Was: signed, implementation-defined narrowing, mixed int64/uint32 arithmetic */
int16_t conn_evt_offset = conn_event_count - conn_evt_current;
if ((int64_t)sync_offset_us + (int64_t)conn_evt_offset * conn_interval_us < 0) { ... }

/* Now: unsigned wrap-safe, CIS_IND-style */
uint16_t conn_evt_latency = (conn_evt_current - conn_event_count) & 0xFFFFU;
if (conn_evt_latency <= 0x7FFFU) {
    /* reference CE reached/passed - deduct elapsed time from sync_offset_us */
} else {
    /* reference CE still in the future - add remaining time */
}

Behavior is preserved for every input in the range the previous signed path could represent.