ISO boot support with sysfb display handoff: kernel detection, kexec patches, test harness

[tlaurion]

Summary

Adds USB ISO boot with kernel-level display driver detection and a
complete framebuffer handoff chain (coreboot → kexec → target kernel).

---

kexec-tools patches

• 0001-build-fixes: cross-compilation fixes for musl-gcc toolchain
• 0002-EBDA-segment-0: EBDA segment 0 preservation for Xen multiboot
• 0003-EFI-VGA-set-VLFB-type-for-sysfb-display: sets orig_video_isVGA=0x23
  (VLFB) for EFI VGA framebuffers so the target kernel applies the 16-bit
  lfb_size shift needed by sysfb display drivers.

ISO boot

• 7-step boot flow: signature verify → mount → loopback.cfg parse →
  probing/fast-path gate → initramfs compat → params → boot menu
• _strip_grub_vars(): removes unresolved GRUB variables from loopback.cfg;
  universal fallback ADD params provide absolute ISO paths for all 7 frameworks
• _check_kernel_probe_driver(): decompresses target kernel bzImage and
  searches for built-in display driver symbols in priority order:
  vesadrm_probe → vesafb_probe → simpledrm_probe + sysfb_parse_mode
• boot_marker(): three-state [OK]/[~]/[X] per-entry compatibility markers
  combining filesystem and display driver results
• verify_global_hashes() moved to gui_functions.sh for cross-script access

Display handoff

• EFI VGA framebuffers are normalized to VLFB (0x23) so the target kernel's
  sysfb_create_simplefb() applies the required 16-bit lfb_size shift
• Actual stride is read from /dev/fb0 fix.line_length rather than assumed
  from width×bpp, correct for all pixel formats and alignment padding
• color-format masks are left as /dev/fb0 reports them; sysfb_parse_mode()
  matches via SIMPLEFB_FORMATS comparison

Documentation

• kexec_handoff.md: 3 display paths (simpledrm, vesadrm, vesafb), patch
  details, stride handling, debug log diagnosis, per-distro results
• iso_boot.md: 7 initramfs frameworks, universal ADD param reference,
  GRUB variable stripping, detection symbol priority
• architecture.md: hardware root of trust (S-CRTM), Purism boot modes
• boot-process.md: updated ISO boot flow with marker descriptions

Test harness

• iso-boot-test.sh: host + initramfs compatible, 18 unit tests,
  138 per-ISO full-chain checks across 15 distros

Hardware validated

• x230 (libgfxinit): Debian 13, Tails 7.8 — stride 5504 preserved
• nv4x_adl (FSP GOP): openSUSE 7.x — vesadrm binds, stride OK
• QEMU: PureOS, Ubuntu, NixOS, Kicksecure — all markers correct

[tlaurion]

This might impact librem l1um v1 kexec handoff @JonathonHall-Purism. Changes of UX, but most importantly, VLFB made compatible under patches/kexec-tools for vesafb and simpledrm (so Ubuntu doesn't leave users in the dark as per #1641, requiring users to type LUKS key pass in the dark before drm+gpu drivers kick in after kexec'ed initramfs)