riscv64: PLIC base address DTB-discovered, QEMU-virt constant as fallback (§V.3 item 3)

plic_init() now takes boot_info->dtb (threaded through apic_init()) and
tries fdt_find_node_by_compatible(dtb, "sifive,plic-1.0.0") ->
fdt_find_prop_in_node(..., "reg", ...) before falling back to the
QEMU-virt-specific constant it previously hardcoded unconditionally.
Reuses the node-scoped DTB lookup primitive built for the aarch64 GIC
base fix unchanged. s_plic_base is now a runtime uintptr_t, same shape
as apic.c's s_gicd_base/s_gicc_base.

This system's QEMU/UEFI riscv64 firmware does not forward a DTB to the
guest (timer.c's own timebase-frequency read falls back too, confirmed
in this boot's own log), so only the no-DTB fallback branch is exercised
here -- the success branch (a real DTB with a matching PLIC node) stays
unverified until real Milk-V Mars hardware. FABRIC-3.md's first-drafted
claim that the success branch would run (based on a stale comment in
plic.c's own pre-fix header) was checked against the actual log and
corrected before this commit.

3-arch acceptance: amd64/aarch64 don't compile these files, so their
runs are non-regression on untouched files only. riscv64's own boot log
confirms the fallback path prints exactly as designed and boot reaches
zuse)ok> unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

include/starkernel/plic.h

@@ -14,6 +14,11 @@
  * at all before this item. Pure substrate: this item wires the mechanism
  * (claim/dispatch/complete) with no permanent source enabled by default;
  * a real consumer (4.3.5b, virtio-keyboard) enables its own source later.
+ *
+ * @c plic_init() takes the boot DTB as of FABRIC-3.md §V.3 item 3's fix,
+ * 2026-09-05: the base address was previously a QEMU-virt-specific
+ * hardcoded constant, unconditionally wrong on the Milk-V Mars's real
+ * JH7110 PLIC. See @c plic.c's file header for the discovery mechanism.
  */
 
 #ifndef STARKERNEL_PLIC_H
@@ -28,9 +33,14 @@
  * Also sets sie.SEIE. Does not touch sstatus.SIE -- arch_enable_interrupts()
  * still owns that, same as the timer.
  *
+ * @param dtb Candidate devicetree blob (@c BootInfo->dtb); NULL-safe. When
+ *            a real @c "sifive,plic-1.0.0" node is found, the PLIC base
+ *            address is read from its @c reg property; otherwise falls
+ *            back to the QEMU-virt-machine constant, unchanged from this
+ *            function's previous unconditional behaviour.
  * @return 0 on success.
  */
-int plic_init(void);
+int plic_init(const void *dtb);
 
 /** Set a source's interrupt priority (1-7; 0 means "never interrupt"). */
 void plic_set_priority(uint32_t irq, uint32_t priority);