FABRIC.md §25: GAP-B1 verified and fixed — no DTB access exists

Read BootInfo (uefi.h:624-639): memory map, runtime services, ACPI,
framebuffer, stack, args -- no FDT pointer. The only FDT mentions in the whole
kernel tree are comments in riscv64/timer.c acknowledging one would be needed.
Items 0.3 and 0.6 instructed "read from the device tree" against a kernel that
cannot reach one.

Item 0.3 now carries the prerequisite explicitly: capture the DTB pointer from
the EFI configuration table into a new BootInfo field in the shared loader,
serving both 0.3 and 0.6. Item 0.6 references that field and, if the DTB is
unreachable on aarch64 EDK2, requires stop-and-report rather than falling back
to constants unilaterally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

FABRIC.md

@@ -2013,9 +2013,13 @@ on until there is a tick on all three architectures (§16.1, §16.5).*
   least one trap. Exceptions still halt with the same diagnostic as before.
 
 - [ ] **0.3 — riscv64: SBI timer and real time base.**
-  Arm the timer via the SBI TIME extension. Switch the time base from `rdcycle` to the
-  `time` CSR and take its frequency from the device tree `timebase-frequency`, with a named
-  fallback constant — not a bare magic number (§16.2).
+  **First, the prerequisite this item silently assumed (B1 verified it absent):** the
+  kernel has no DTB access — `BootInfo` (`uefi.h:624-639`) carries no FDT pointer and no
+  FDT code exists in the tree. Capture the DTB pointer from the EFI configuration table
+  (DTB table GUID) into a new `BootInfo` field in the shared loader. This also serves 0.6.
+  Then: arm the timer via the SBI TIME extension. Switch the time base from `rdcycle` to
+  the `time` CSR and take its frequency from the device tree `timebase-frequency`, with a
+  named fallback constant — not a bare magic number (§16.2).
   *Done when:* `heartbeat_ticks()` advances on riscv64 and the tick interval matches the
   configured rate within measurement noise. Verify the SBI extension is present before
   relying on it; if it is absent, stop and report rather than falling back silently.
@@ -2035,7 +2039,11 @@ on until there is a tick on all three architectures (§16.1, §16.5).*
 - [ ] **0.6 — aarch64: minimal GICv2.**
   Enable the distributor and CPU interface, set the priority mask, enable the timer PPI,
   acknowledge via `IAR` / `EOIR`. **Read the base addresses and the PPI INTID from the
-  device tree — do not take them from memory or from this document.**
+  device tree — do not take them from memory or from this document.** The DTB pointer
+  comes from the `BootInfo` field added in 0.3 (B1 verified no such field existed). If the
+  DTB turns out to be unreachable on aarch64 EDK2, stop and report — deciding between
+  loader work and named QEMU-virt constants with a recorded caveat is Captain Bob's call,
+  not the implementer's.
   *Done when:* the timer interrupt is delivered and acknowledged. Scope is one interrupt;
   a general GIC driver is out of scope and must not be written.