SMP bring-up of all four Cortex-A76 cores, firmware mailbox (power, clocks, temperature, throttling), watchdog and cpufreq policy for the TV profile

Epic: #113 · Milestone: MC2 — Pi 5 bring-up

Why

Software H.264 decode and the UI loop need all four cores; the idle budget (≤ 3 W) needs down-clocking and wfi. The VideoCore firmware still services the mailbox property interface on Pi 5 (clock rates, temperature, throttle flags, power domains) — rpi/mailbox_vc7.home (465) sketches it; power/{power,cpufreq,thermal}.home import it but nothing has run.

Tasks

• Spin-table SMP: release cores 1–3 from boot.s's wfe loop with per-core stacks, per-CPU GIC redistributor init, per-CPU timer; the existing scheduler's per-CPU run queues (sched/cfs.home) enabled on ARM.
• Mailbox property channel over the BCM2712 mailbox registers (from DTB): get board revision/serial, ARM/core clock get/set, temperature, throttled flags, firmware revision. fw shell command.
• Watchdog (PM block) armed during boot, fed by the TV shell's heartbeat; reboot on hang (needed by OTA rollback in #109).
• cpufreq policy: ondemand via mailbox with 1.5 GHz floor during playback, min clock + wfi idle otherwise; thermal throttle callback logged.
• Milestones [SMP] 4 CPUs online, [Mailbox] firmware <rev>, [Thermal] <temp>.

Acceptance

ps shows tasks on 4 CPUs; fw prints a plausible temperature; power-idle gate in #49 reads ≤ 3 W at the plug with the serial shell idle.

Size: M · Depends on: #61 · Blocks: #88, #109