Added generic BSP framework and PolarFire SoC Icicle Kit target

[AmmarOkla12772]

Adds a Microchip PolarFire SoC Icicle Kit target for ThreadX, built on a new
reusable BSP framework, with a Renode-based CI pipeline that runs the demo in
emulation on every push.

What the contribution adds

Thanks to @AmmarOkla12772 for the target and the framework behind it:

• PolarFire SoC target — startup, linker script, MMUART1 console, CLINT tick
  source, PLIC configuration for Hart 1 (u54_1), and a ThreadX demo exercising
  threads, queues, and timers.
• Reusable BSP framework — board_init, hwtimer, and console behind a
  board-agnostic interface with a board_config.h per target, plus a
  templates/target skeleton for new ports.
• Renode CI pipeline — builds the demo and boots it under emulation, with a
  test_renode.py harness and a polarfire_demo.robot suite.
• Runtime self-tests — dynamic checks for _sbrk bounds, timer catch-up, and
  queue integrity, so the demo verifies its own platform layer at startup rather
  than trusting it.
• Trap handling — early mtvec initialisation, synchronous trap dispatch
  separated from interrupt context save, deliberate timeout and trap hooks for
  testing, and a port collision fix.

Review follow-ups

The remaining commits address the outstanding review items. Three of them are
correctness fixes where the code looked right and the tests agreed with it.

PLIC machine-mode context

plic.h programmed context 2, the supervisor-mode context for u54_1; the
machine-mode context for that hart is context 1. The PLIC silently accepts a
write to the supervisor context, but the machine-mode enable bitmap stays clear,
so MEIP never asserts and MMUART1 interrupts were never delivered.

Threshold/claim move to 0x0C201000/0x0C201004 and the enable word to
0x0C002088. Both the context and the enable-word offset are now derived from
the source ID instead of hardcoded.

Self-tests could not fail the build

run_startup_self_tests() printed All startup verification tests PASSED!
unconditionally, and test_renode.py grepped for exactly that string — so a
failing sub-test still produced a green build. Results now feed a failure counter
that decides the summary line, and the harness fails on any [-] FAIL:.

The harness exit code also considered only ticks and the alarm, discarding the
self-test and PLIC-RX flags it had already computed. All four assertions now gate
the result, and a failing self-test no longer stops the run — one failure reports
the state of every other assertion instead of hiding it.

The PLIC path was never actually exercised

Register readback cannot tell a correct PLIC context from an incorrect one; only
a delivered interrupt can. The harness wrote a byte to MMUART1 to trigger one,
but Renode does not read its monitor from stdin (it logs "Monitor available in
telnet mode on port 1234"), so the byte was discarded and the RX assertion never
fired.

renode/polarfire_ci.resc now drives the run: fixed virtual-time steps via
emulation RunFor, the byte injected with WriteChar, then quit. The run is
reproducible and terminates on its own instead of depending on wall clock. It
duplicates the machine setup rather than including polarfire_demo.resc, because
Renode expands $ORIGIN only in variable assignment — an included script cannot
be located relative to its includer, and both include @$ORIGIN/... and a bare
relative include hang the process rather than reporting an error.
polarfire_demo.resc stays free-running for interactive use.

Verified locally against Renode 1.16.1, both directions:

PLIC context	Result	Harness exit
1 (machine)	[Console RX] PLIC IRQ 91 handled: byte 'X'	0
2 (supervisor)	no RX line	1

Both builds print an identical [+] PASS: PLIC Hart 1 (IRQ 91 prio=1 en=0x08000000 thresh=0 mie=0x800) line, which is the point.

Timer catch-up self-test

The self-test staged mtimecmp eight ticks behind by subtracting from mtime.
Renode starts mtime near zero, so the subtraction underflowed to 2^64-79900
and the test failed itself in CI. The production clamp was never wrong; the test
fed it a value real code cannot produce.

The catch-up decision is now hwtimer_next_cmp(), a pure function of the current
comparand and mtime, with hwtimer_ack() a thin wrapper. The test covers both
branches with synthetic values and touches no CLINT register — so the demo no
longer writes mtime at all, which matters because that register is the
platform-wide monotonic counter shared by every hart and this code is meant to be
copied.

Also

• Hardened _sbrk() in templates/target — the copy-me template: bounds check
  against BSP_RAM_END, reject underflow and pointer overflow, return
  (void *)-1 with errno, and take ptrdiff_t so it stays correct on 64-bit.
• Implemented __malloc_lock/__malloc_unlock instead of leaving them empty, so
  the newlib arena is genuinely serialised rather than only appearing to be.
• Gave the tick source one owner: _tx_initialize_low_level calls
  hwtimer_init, board_init handles board peripherals — so board_init no
  longer runs twice.
• Replaced the TX_TIMER_TICKS_PER_SECOND fallback in hwtimer.h with
  BSP_TICK_RATE_HZ in board_config.h. The BSP does not see the ThreadX
  headers, so the fallback silently applied whenever the two disagreed; main.c
  sees both and now carries a C99 compile-time check that they match.
• Derived the demo sleep intervals from TX_TIMER_TICKS_PER_SECOND.
• Pinned Renode to 1.16.1, checksum-verified both CI downloads, and added
  timeout-minutes to both jobs as a backstop.
• Updated polarfire_demo.robot, which asserted on telemetry strings the demo no
  longer emits, and added an RX interrupt case; corrected the target README,
  whose expected-output block showed the same stale strings.
• Corrected the architecture.md tree and normalised the licence URL to the form
  used in AGENTS.md.

Co-authored-by: Ammar Okla ammargawkla@gmail.com
Co-authored-by: Frédéric Desbiens frederic.desbiens@eclipse-foundation.org