fix(raspi): the Pi 5's native path turns the MMU and caches on before any C; bounded mailbox; framebuffer address from dma-ranges

boards/BRINGUP.md R2/R3, FABRIC-3 SXXXIX.  The entry stub cleans the cache
over the image, builds an identity map (the image's GiB Normal, the rest
Device) and enables MMU and caches at EL2 (or EL1); rpi5_mmu.c makes the
devicetree's RAM Normal and the framebuffer uncached.  Mailbox waits give
up after one second; the buffer is cleaned around the exchange; the
framebuffer address goes through dma-ranges, not a Pi 4 mask.

New rpi5-rehearsal target runs the native image on QEMU virt at EL2.  It
found three more that would each have stopped the board: the PL011 shift
(mine, c9519173; the host test asserted it), the GIC address not carried
through /soc's ranges (new fdt_reg_address(), checked against the real
Pi 5 DTB), and no timer IRQ at EL2 (HCR_EL2.IMO/FMO/AMO).

Rehearsal: POST 1052 passed, same parity hash as UEFI.  Standard acceptance
on three ISAs: POST 1052, hash 0x82f4ae7cb2e2d424.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/linker/starkernel-native-rpi5.ld

@@ -24,7 +24,10 @@ ENTRY(rpi5_native_start)
 
 SECTIONS
 {
-    . = 0x80000;
+    /* RPI5_NATIVE_BASE comes from kernel/Makefile (--defsym): 0x80000 on
+     * the Pi 5; 0x40080000 for the QEMU virt rehearsal only, whose RAM
+     * starts at 0x40000000 and which loads a raw image 0x80000 into it. */
+    . = RPI5_NATIVE_BASE;
 
     __kernel_start = .;