Fix ARMv6-M/ARMv7-M SVCall register corruption in protected builds, fix lm3s6965-ek:qemu-protected boot, and add board documentation.

[jasonbu]

Summary

Fix the lm3s6965-ek:qemu-protected configuration to boot successfully under QEMU, and add board documentation.
Commit 1: fix qemu-protected to boot in QEMU
The protected build failed to boot due to three independent issues:

• memory.ld: ksram (16K) was too small for kernel BSS + idle thread stack. Rebalanced to ksram=20K, usram=20K, xsram=24K.
• defconfig: CONFIG_FS_TMPFS caused the kernel binary to exceed the 128KB kflash partition. Removed it.
• defconfig: The default TLS_LOG2_MAXSTACK=13 (8KB alignment) caused memalign(8192, stack_size) to fail in the 16KB user heap — there was simply not enough contiguous aligned memory to allocate the init task stack. Reduced to TLS_LOG2_MAXSTACK=11 (2KB alignment).
  Commit 2: add lm3s6965-ek board documentation
  New index.rst covering hardware features, all available configurations (nsh, qemu-flat, qemu-protected, qemu-kostest, qemu-nxflat, etc.), QEMU run instructions for both FLAT and PROTECTED builds (including networking and the -device loader trick for user binaries), and GDB debugging steps. Also adds a "Supported Boards" toctree to the Tiva platform index.
  Commit 3: fix callee-saved register corruption in arm_dispatch_syscall
• armv7-m: The old code did mov r11, sp at entry, clobbering the user-space r11 value. When SYS_syscall_return restored the exception frame, the corrupted r11 leaked back to user space, causing parameter corruption on subsequent syscalls and eventual system hangs. Fix: remove mov r11, sp (it was only used for CFI, replaced with .cfi_def_cfa_offset).
• armv6-m: r4 was used to load g_stublookup and the stub address (Thumb-1 cannot use ip for indexed loads), but was never restored before svc SYS_syscall_return. The corrupted r4 propagated back to user space. Fix: add ldr r4, [sp, #0] to restore r4 from the stack frame before the return SVC.

Impact

• Protected build users on ARMv6-M / ARMv7-M: Fixes silent register corruption that could manifest as corrupted syscall parameters, wrong return values, or system hangs — particularly visible with complex syscalls like read on procfs (e.g., the free NSH command).
• lm3s6965-ek board users: The qemu-protected configuration now boots and runs correctly under QEMU.
• Documentation: New board documentation for lm3s6965-ek; no code impact.
• Compatibility: No API changes. The armv8-m arm_dispatch_syscall.S is not modified (it does not have the mov r11, sp pattern).

Testing

Tested on lm3s6965-ek:qemu-protected under QEMU:

$ ./tools/configure.sh -l lm3s6965-ek:qemu-protected
$ make -j$(nproc)
$ qemu-system-arm -M lm3s6965evb -nographic \
    -kernel nuttx.bin \
    -device loader,file=nuttx_user.bin,addr=0x20000

Verified:

1. System boots to NSH prompt (previously hung during init)
2. free command displays memory info correctly (previously caused system hang)
3. Basic NSH commands (ls, ps, help) work without corruption
4. No regressions on lm3s6965-ek:qemu-flat build
   Documentation tested with make html — renders correctly with no Sphinx warnings.