riscv: forced halt, best-effort IPI now, SBI SSE when available

[congwang-mk]

Part of the RISC-V port. Weakest point of the architecture.

S-mode has no NMI: sip.SSIP is masked by sstatus.SIE, and SBI has no "stop another hart". A spawn spinning with interrupts off cannot be reclaimed by any standard means today.

• Now: best-effort. mk_force_stop_cpu(hartid) sends the doorbell IPI; the spawn's stop handler (registered like IPI_CPU_STOP) calls HART_STOP. mk_arch_register_force_stop() returns success but logs that force-halt is best-effort; mk_instance_settle_halted() reports harts that never reach STOPPED so the host does not overwrite the image under them.
• Next: SBI SSE (Supervisor Software Events, SBI v3.0): firmware-injected, delivered regardless of sstatus.SIE, per-hart addressable. Not in this tree (SBI_EXT_SSE absent from asm/sbi.h); OpenSBI 1.5+ implements it and Linux patches exist upstream. Track the merge; when available, register a private SSE event whose handler calls HART_STOP, and have the host inject it per hart. This is the RISC-V equivalent of SDEI on arm64 (arm64: forced halt via SDEI, pseudo-NMI SGI, plain SGI fallback #17).
• Filter foreign stop IPIs as x86 does in smp.c / reboot.c.