arm64: SMMU bypass / stage-2 containment for devices assigned to a spawn #18

Part of the arm64 port.

x86 currently runs assigned devices without an IOMMU inside spawns. On arm64 the SMMU is shared and host-owned; the spawn DTB omits the SMMU node and lists devices without iommus, so the spawn uses direct DMA. The host must make that safe:

• On device assignment, install for the device's StreamIDs either a bypass STE (parity with x86) or, better and cheap on SMMUv3, a stage-2 table covering exactly the instance's memory grant so a buggy spawn driver cannot DMA into the host.
• Update the stage-2 mapping on memory hot-add/remove (mk_send_mem_add/remove paths) and tear it down on device return.
• DTB: mark dma-coherent correctly per device; on SBSA servers PCIe is coherent.
• Out of scope: SVA/PASID, nested translation.

Can be deferred for first bring-up on hardware where an unrestricted NIC is acceptable, but must land before any multi-tenant use.