First pixel on the Pi 5: mailbox property-channel framebuffer (allocate, set physical/virtual size, depth, pitch) + the existing PSF console on HDMI — HIL gate `fb-pi5-first-pixel`

Epic: #113 · Milestone: MC4 — Display & 2D

Why

The VideoCore firmware still honours the mailbox framebuffer tags on the Pi 5, giving a linear ARGB framebuffer on HDMI without touching HVS or HDMI registers. That is the cheapest way to see the boot log on a TV and to unblock UI work while the real modeset driver (#74) is built. The x86 path already has fb_console.home (1,068 lines, PSF1/2, CI-asserted) and bochs_vbe.home as the mode-setting backend; this is the Pi equivalent of bochs_vbe.

Tasks

• platform/bcm2712/mailbox_fb.home: property tags 0x40001 (allocate), 0x48003/48004 (size), 0x48005 (depth), 0x48006 (pixel order), 0x40008 (pitch); 16-byte aligned message buffer in uncached memory (or with cache clean/invalidate around the call); bus→ARM address translation of the returned pointer; map it Device or Normal-NC.
• drivers/framebuffer.home gets a backend interface: bochs_vbe (x86) and mailbox_fb (Pi); fb_console unchanged.
• Boot log replay onto HDMI (the same replay used on x86).
• Rig gate: scripts/pi/pi-capture.sh grabs an HDMI frame; assert it is not a flat colour and that OCR/template-match finds HomeOS (or simpler: assert the checksum of a known test pattern drawn after the log).

Acceptance

fb-pi5-first-pixel passes on the rig: captured frame shows the boot log; milestone [FB] mailbox 1920x1080x32.

Size: M · Depends on: #63, #64 (mailbox) · Blocks: #75, #92 (interim backend)