PASS: actual drill_safe_boot writes physical RUN/sleep/PWM-off and charger-disable pins from both prior register states; unrelated GPIO modes preserved. No physical voltages measured.
