feat: Phase C DMEM/FBIF probe in pmu_investigate — closes PMU software path

Adds investigate_pmu_phase_c() and PhaseC result struct:
- PIO DMEM read/write test (HS returns 0xDEAD5EC2 sentinel)
- Queue HEAD write test (read-only in HS mode)
- Doorbell/interrupt injection test (blocked)
- Falcon DMA transfer register state capture
- Conditional queue-based PG command injection (if DMEM writable)

Live results: Volta PMU HS lock is comprehensive — only MAILBOX0/1
writable. PMU software path closed for HS-locked firmware.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ecoPrimal