kernel/rv1106: HPMCU mailbox 100% VERIFIED + open NPU driver VERIFIED

MAILBOX (fully open A7<->RISC-V SCR1 round-trip, 5/5 exact echoes on c8a3):
- rockchip-mailbox.c: rv1106 has 1 shared IRQ, not 4/channel -> added
  rv1106_drv_data{num_chans=1} + compatible (rk3368 fallback assumed 4 -> probe
  failed 'IRQ index 1 not found').
- clk-rv1106.c: CLK_CORE_MCU (SCR1 core clock) marked CLK_IGNORE_UNUSED -
  6.18's clk_disable_unused() was switching off the coprocessor clock so a
  loaded firmware never ran (5.10 left it on).
- Open SCR1 echo firmware (scr1-echo/, 154B RV32IMC) + load/test scripts;
  A2B_INTEN on the MCU side + CMD-then-DAT (DAT=doorbell) order. Loaded via the
  proven hpmcu.rs SRAM path; do NOT kill warden-flared (dw-wdt). mailbox/VERIFIED.md.

NPU (open GPL rknpu 0.9.2 kernel driver on 6.18):
- DT fix: base npu node lacks interrupt-names, driver requests IRQ byname
  'npu_irq' -> probe bailed -ENXIO. Added interrupt-names='npu_irq'.
- Verified: [drm] Initialized rknpu 0.9.2 on minor 1; /dev/dri/card1;
  rknpu_version_test PASS (0.9.2 + hw version, full power/clock/reset path).
- Honest ceiling: open compute (regcmd compiler) is a from-scratch ~person-year
  RE project, no RV1106 prior art; ship the driver, no blob. npu/VERIFIED.md.

DRIVER-PARITY + CAPABILITIES-AUDIT updated; dts snapshot refreshed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

kernel/rv1106-enablement/dts/rv1106-warden.dts

@@ -245,3 +245,26 @@
 		};
 	};
 };
+
+/* --- HPMCU mailbox (A7 <-> RISC-V SCR1). Controller binds via the rk3368
+ * fallback compatible with zero driver patch; @ff5c0000 is the HPMCU-connected
+ * instance (SRST_CORE_MCU on the Linux side, MBOX_BASE 0xFF5C0000 on the MCU
+ * side). M-MBOX-1 proves the controller; M-MBOX-2 adds the SCR1 echo + round-trip. */
+&mailbox {
+	status = "okay";
+};
+
+/* --- NPU (rknpu, ff660000). Kernel driver ported from the vendor 5.10 BSP
+ * (GPL source port -- see warden-sdk/kernel/rv1106-enablement/npu/PORT-PLAN.md
+ * and PORT-PROGRESS.md). compatible/reg/interrupts/clocks/resets are already
+ * fully specified in rv1106.dtsi's rv1106_rknpu_config-matching npu node --
+ * this is only the status flip, same pattern as every other block enabled
+ * in this file. No iommus= property (this board's NPU runs non-iommu,
+ * matching the 5.10 boot-log finding), no power-domains (single-rail). */
+&npu {
+	/* the rknpu driver requests its IRQ by name ("npu_irq"); the base dtsi
+	 * node declares the interrupt but no interrupt-names, so probe fails
+	 * "IRQ npu_irq not found" without this. */
+	interrupt-names = "npu_irq";
+	status = "okay";
+};