Final PTZ camera update:
It's e-waste. Nobody anywhere, even the OEM, has the USB/FPGA firmware bin files needed to unbrick the camera.
The SoC works, and I can interact with the webapp, but the camera functions and PTZ controls are cooked. We can even flash an older firmware image which is the USB firmware+JFFS2 filesystem, but no FPGA code anywhere.
:(