fwmanager: Add BootMonitor capability and GpioBootMonitor adapter

[chrysh]

BootMonitor reports a device's boot liveness as BootStatus in the api leaf crate; GpioBootMonitor implements it over one HAL GpioPort input line. MonitorError meets the core::error::Error bound and keeps the concrete HAL error reachable through source(). new() rejects empty pin masks; boot latches are cleared by the reset path, never the observer.

Closes 9elements#6.

(Replaces 9elements#20, which was opened against the fork's main by mistake.)

[leongross]

lgtm

[rusty1968]

API usage model

Consider this bare metal toy example just for illustration purposes.

use fwmanager_api::{BootMonitor, BootStatus};
use orchestrator_sm::{ComponentId, Event, Orchestrator, Platform};

/// The shell's per-component boot watch. Called after the SM has emitted
/// `Effect::ReleaseReset(id)` for `id` and the platform actually let it go.
///
/// This is the *only* place `BootStatus` crosses into the SM: a `Booted` read
/// becomes `Event::Booted`, a device-reported `Failed` short-circuits into
/// recovery, and "still `Booting` when the budget runs out" is the watchdog
/// firing `Event::Timeout`. Reset / authenticate / measure never appear here —
/// the SM already drove those before it emitted `ReleaseReset`.
fn watch_boot<const N: usize, const E: usize, M, P>(
    sm: &mut Orchestrator<N, E>,
    platform: &mut P,
    monitor: &M,
    id: ComponentId,
    poll_budget: usize,
) where
    M: BootMonitor,
    P: Platform,
{
    for _ in 0..poll_budget {
        match monitor.boot_status() {
            // Came up: hand the SM its post-release liveness event. The SM
            // clears this component's boot-progress watchdog and advances the
            // chain walk (or, for an Active part, this pairs with ComponentReady).
            Ok(BootStatus::Booted) => {
                sm.dispatch(platform, Event::Booted(id));
                return;
            }

            // Released but not up yet — not a failure. Keep waiting inside the
            // budget; the SM is unaware a poll even happened.
            Ok(BootStatus::Booting) => continue,

            // Device reported a fault. The SM has no dedicated "boot failed"
            // event — a device that doesn't come up enters recovery via the
            // boot-progress watchdog — so surface an early, explicit fault as
            // that same Timeout path instead of waiting the window out.
            Ok(BootStatus::Failed) => {
                sm.dispatch(platform, Event::Timeout(id));
                return;
            }

            // Couldn't even read the signal. Treat an unreadable liveness
            // channel as no-progress and let recovery decide.
            Err(_e) => {
                sm.dispatch(platform, Event::Timeout(id));
                return;
            }
        }
    }

    // Budget exhausted, never saw Booted: the boot-progress watchdog fires.
    // The SM routes Timeout(id) for an awaiting component straight into recovery.
    sm.dispatch(platform, Event::Timeout(id));
}