riscv: SBI HSM based spawn, confirm-parked and release #23

Part of the RISC-V port.

SBI HSM is the trampoline. HART_START(hartid, addr, opaque) enters at addr in S-mode (HS with H-ext) with satp = 0, interrupts masked, a0 = hartid, a1 = opaque. The Linux boot protocol (arch/riscv/kernel/head.S, _start_kernel) is a0 = hartid, a1 = DTB. Same contract.

Implement in arch/riscv/multikernel/spawn.c, using direct sbi_ecall(SBI_EXT_HSM, ...) since cpu_ops_sbi.c keeps its wrappers static:

• mk_arch_spawn_instance(image, instance, cpu): HART_START(hartid, stub_pa, dtb_pa) where stub_pa is the fence.i entry stub (see the I-cache issue), which tail-jumps to image->start with a0/a1 preserved.
• mk_arch_confirm_parked(instance, hartid): HART_STATUS(hartid) == SBI_HSM_STATE_STOPPED, with a bounded poll for STOP_PENDING as sbi_cpu_is_stopped() callers do.
• mk_arch_release_instance(): free the record only; nothing is parked anywhere.
• mk_repark_*(): no-ops returning 0 (a STOPPED hart belongs to whoever calls HART_START next).
• Host pool CPUs leave through stock arch_cpu_idle_dead() -> sbi_cpu_stop(); nothing to add.
• Error mapping: HART_START returning SBI_ERR_INVALID_PARAM/DENIED for a hart outside the host's OpenSBI domain must produce a clear "hart not startable from this domain" message (see the OpenSBI domains issue).

Ownership is not enforced by firmware (same trust model as INIT/SIPI and PSCI CPU_ON).