RX-timeout error path leaks queued read allowances and stale FIFO state into the next same-slave transaction

Summary

The RX-timeout jump leaves 1-2 outstanding RD allowances + partial RX bytes; set_slave_addr early-returns for the same slave so no flush happens - the stale allowances execute on the next transfer and their bytes are delivered as legitimate data (for block reads the corrupted first byte IS the count). IG4_I2C_ABORT is never used anywhere in the driver; the rcount==1 block-read case is unreachable-except-by-timeout. Abort-and-drain-on-error fix.