arch/aarch64: fix VBAR_EL2 stale comment + hardcode HVC PSCI conduit

FABRIC-3.md §IV.3 item 7's code audit found two more findings; fixed both
per direct instruction naming them specifically.

Comments only, no behavior change:
interrupts.c's arch_interrupts_init() doc comment (and its matching
runtime EL2 console message) claimed VBAR_EL2 was "a known gap... not yet
wired." Checked against isr.S's aarch64_install_vectors() and found that
claim stale: the assembly already branches on aarch64_current_el() and
writes vbar_el2/vbar_el1 correctly, threading the same answer through
el2_mode_flag for the IRQ trampoline's ELR/SPSR selection too. There was
no gap to close -- only the comment was wrong. Also fixed a same-vintage
one-word staleness in arch.c's aarch64_install_vectors extern comment
("installs VBAR_EL1" -> EL-aware), caught while touching this.

Real behavior change, gated to preserve existing QEMU behavior:
arch_cold_reset() hardcoded the PSCI conduit to HVC, a documented
QEMU-specific workaround (QEMU's AAVMF has no genuine EL3 to answer SMC).
Real Pi 5 hardware's ATF means EL3 exists there; confirmed further this
pass that bcm2712.dtsi's own /psci node declares method="smc" directly,
not just inferred from ATF's presence.

New aarch64_psci_conduit_init(dtb) in arch.c: fdt_valid(dtb) ->
fdt_find_node_by_compatible(dtb, "arm,psci-1.0") ->
fdt_find_prop_in_node(..., "method", ...) -- sets a module-static
s_psci_use_smc flag to 1 only when method reads exactly "smc"; every
other outcome (no DTB, no PSCI node, method="hvc", property absent)
leaves it at its default 0/HVC, preserving this system's existing QEMU
behavior exactly. arch_cold_reset() now branches on that flag between
smc #0/hvc #0. Called once from apic_init() (arch/aarch64/apic.c), the
one point in boot with boot_info->dtb already in hand -- collocated with
its consumer in arch.c rather than defined in apic.c, since
arch_cold_reset() has no boot_info of its own by the time it runs (called
from deep in VM execution, via BYE).

Three-arch QEMU acceptance run exercised both new guard branches: the
aarch64 boot log shows "PSCI: no DTB -- using HVC (QEMU virt-machine
default)" immediately before the existing GIC discovery lines, then
boots clean to zuse)ok> -- confirming the QEMU/UEFI path is unchanged.
The SMC success branch itself stays unverified until real Pi 5 hardware
runs BYE.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

src/starkernel/arch/aarch64/apic.c

@@ -53,6 +53,13 @@
  * interrupts.c: "exception level" has no cross-ISA meaning. */
 extern int aarch64_current_el(void);
 
+/* Defined in arch.c (FABRIC-3.md §IV.3 item 7 fix, 2026-09-04) --
+ * discovers the real PSCI conduit for arch_cold_reset() from the DTB.
+ * Collocated with its consumer there, not defined here, even though this
+ * is the one point in boot with boot_info->dtb already in hand for GIC
+ * discovery -- see arch.c's own doc comment on this function for why. */
+extern void aarch64_psci_conduit_init(const void *dtb);
+
 /* ---- QEMU virt machine constants (fallback when no DTB GIC node is
  * found -- see file header) ----------------------------------------------- */
 #define GICD_BASE_PA_QEMU_DEFAULT   0x08000000UL
@@ -218,11 +225,17 @@ static int gic_bases_from_dtb(const void *dtb, uintptr_t *gicd_out, uintptr_t *g
  *
  * @param boot_info Kernel @c BootInfo; @c dtb is consulted for real-hardware
  *                  GIC base discovery as of the 2026-09-04 fix (previously
- *                  unused — see file header).
+ *                  unused — see file header), and, as of the same fix, for
+ *                  @c aarch64_psci_conduit_init()'s PSCI conduit discovery
+ *                  (arch.c) — bundled into this call for the same reason
+ *                  GIC discovery is: this is the one point in boot with
+ *                  @c boot_info->dtb already in hand.
  * @return 0 always.
  */
 int apic_init(BootInfo *boot_info)
 {
+    aarch64_psci_conduit_init(boot_info ? boot_info->dtb : (void *) 0);
+
     if (boot_info && gic_bases_from_dtb(boot_info->dtb, &s_gicd_base, &s_gicc_base)) {
         console_puts("GICv2: base addresses discovered from DTB (GICD=0x");
         for (int s = 60; s >= 0; s -= 4)