fix(raspi): the Pi 5's native path turns the MMU and caches on before any C; bounded mailbox; framebuffer address from dma-ranges

boards/BRINGUP.md R2/R3, FABRIC-3 SXXXIX.  The entry stub cleans the cache
over the image, builds an identity map (the image's GiB Normal, the rest
Device) and enables MMU and caches at EL2 (or EL1); rpi5_mmu.c makes the
devicetree's RAM Normal and the framebuffer uncached.  Mailbox waits give
up after one second; the buffer is cleaned around the exchange; the
framebuffer address goes through dma-ranges, not a Pi 4 mask.

New rpi5-rehearsal target runs the native image on QEMU virt at EL2.  It
found three more that would each have stopped the board: the PL011 shift
(mine, c9519173; the host test asserted it), the GIC address not carried
through /soc's ranges (new fdt_reg_address(), checked against the real
Pi 5 DTB), and no timer IRQ at EL2 (HCR_EL2.IMO/FMO/AMO).

Rehearsal: POST 1052 passed, same parity hash as UEFI.  Standard acceptance
on three ISAs: POST 1052, hash 0x82f4ae7cb2e2d424.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/Makefile

@@ -1202,15 +1202,65 @@ RPI5_NATIVE_LINKER_SCRIPT := kernel/linker/starkernel-native-rpi5.ld
 RPI5_NATIVE_ELF           := $(BUILD_DIR)/starkernel_rpi5.elf
 RPI5_NATIVE_IMG           := $(BUILD_DIR)/kernel_2712.img
 
+# RPI5_NATIVE_BASE: the image's load address. 0x80000 is the Pi 5's
+# (boards/raspi/config.txt kernel_address). Change it only to rehearse the
+# native path on QEMU's virt machine at EL2:
+#   make -f kernel/Makefile ARCH=aarch64 RPI5_NATIVE_BASE=0x40080000 rpi5-rehearsal
+RPI5_NATIVE_BASE ?= 0x80000
+
 $(RPI5_NATIVE_ELF): $(KERNEL_OBJS) $(RPI5_NATIVE_LINKER_SCRIPT) | $(BUILD_DIR)
 	@echo "LD (rpi5 native) $@"
 	@$(LD) -T $(RPI5_NATIVE_LINKER_SCRIPT) -nostdlib --build-id=none \
+	    --defsym=RPI5_NATIVE_BASE=$(RPI5_NATIVE_BASE) \
 	    -e rpi5_native_start $(KERNEL_OBJS) -o $@
 
 $(RPI5_NATIVE_IMG): $(RPI5_NATIVE_ELF)
 	@echo "OBJCOPY (raw) $@"
 	@$(OBJCOPY) -O binary $< $@
 
+# rpi5-rehearsal: the Pi 5's native path -- no UEFI, raw image, entered at
+# EL2 with the MMU off and x0 = the devicetree -- rehearsed on QEMU's virt
+# machine, which has no Pi 5 model but enters a raw image exactly that way
+# with virtualization=on. Linked at virt's 0x40080000 instead of 0x80000;
+# everything else is the Pi 5 image. One QEMU, foreground, serial to
+# logs/<TS>/aarch64-rpi5/ (2026-10-14, FABRIC-3.md SXXXIX).
+.PHONY: rpi5-rehearsal
+rpi5-rehearsal:
+	@if [ "$(ARCH)" != "aarch64" ] || [ "$(RPI5_NATIVE_BASE)" != "0x40080000" ]; then \
+		echo "rpi5-rehearsal: ARCH=aarch64 RPI5_NATIVE_BASE=0x40080000"; exit 1; fi
+	@rm -f $(RPI5_NATIVE_ELF) $(RPI5_NATIVE_IMG)
+	@$(MAKE) -f kernel/Makefile ARCH=aarch64 RPI5_NATIVE_BASE=$(RPI5_NATIVE_BASE) $(RPI5_NATIVE_IMG)
+	@mkdir -p $(QEMU_LOG_DIR)
+	@TS=$$(date +%Y%m%d-%H%M%S); \
+	mkdir -p $(QEMU_LOG_DIR)/$$TS/aarch64-rpi5; \
+	LOG=$(QEMU_LOG_DIR)/$$TS/aarch64-rpi5/qemu-aarch64-rpi5-$$TS.log; \
+	SERIAL_SOCK=$(BUILD_DIR)/qemu-serial-aarch64-$$TS.sock; \
+	QMP_SOCK=$(BUILD_DIR)/qemu-qmp-aarch64-$$TS.sock; \
+	echo "=== Rehearsing the Pi 5 native path on QEMU virt at EL2 ==="; \
+	echo "  Serial log: $$LOG"; \
+	touch $$LOG; \
+	qemu-system-aarch64 \
+		-machine virt,virtualization=on \
+		-cpu cortex-a76 \
+		-kernel $(RPI5_NATIVE_IMG) \
+		-drive id=artdisk,file=$(ARTDISK),format=raw,if=none \
+		-device virtio-blk-pci,drive=artdisk \
+		-device virtio-keyboard-pci,addr=0x3 \
+		-device qemu-xhci,id=xhci0,addr=0x4,p2=$(XHCI_PORTS),p3=$(XHCI_PORTS) \
+		$(ZUSEDISK_QEMU_ARGS) \
+		-object rng-random,id=rng0,filename=/dev/urandom \
+		-device virtio-rng-pci,rng=rng0,addr=0x5 \
+		-chardev socket,id=cserial,path=$$SERIAL_SOCK,server=on,wait=off,logfile=$$LOG \
+		-serial chardev:cserial \
+		-qmp unix:$$QMP_SOCK,server=on,wait=off \
+		$(QEMU_EXTRA) \
+		-display none \
+		-m 4096 \
+		-no-reboot \
+		-d guest_errors; \
+	rm -f $$SERIAL_SOCK $$QMP_SOCK; \
+	echo "=== Serial log: $$LOG ==="
+
 .PHONY: boot_image
 ifeq ($(strip $(BOARD)),)
 boot_image: