boards: Add Star Labs Heads targets

[Sean-StarLabs]

Add Heads support for the Star Labs target set, continuing the original StarLite Mk V PR as a patch-per-board series.

Scope

• Pin Star Labs coreboot 26.07.1.
• Add the shared Star Labs configuration and compact profiles.
• Keep StarLite Mk V / Lite ADL as the existing CI-covered seed target.
• Add one signed commit per additional board target:
  • starlabs_qemu
  • starlabs_starbook_mtl
  • starlabs_starbook_adl
  • starlabs_starbook_adl_n
  • starlabs_starbook_rpl
  • starlabs_starbook_tgl
  • starlabs_labtop_cml
  • starlabs_labtop_kbl analysis target
  • starlabs_adl_horizon
  • starlabs_byte_adl
  • starlabs_byte_twl
  • starlabs_byte_cezanne
  • starlabs_starbook_cezanne
  • starlabs_lite_glk analysis target
  • starlabs_lite_glkr analysis target
  • starlabs_starfighter_mtl
  • starlabs_starfighter_rpl
• Add the Cezanne AMD input verifier and fTPM/TPM-log coreboot patches needed by the Cezanne targets.

Initial installation and recovery require board-appropriate external recovery access. For StarLite Mk V, the current recovery reference remains:
https://support.starlabs.systems/hc/star-labs/articles/starlite-mk-v-installingrecovering-firmware-with-external-programmer

The related vendor, porting and flashing documentation is under review in linuxboot/heads-wiki#222. The flashing page remains unpublished until this port is merged and hardware-tested.

Validation

• All continuation commits are GPG signed and carry Signed-off-by: Sean Rhodes <sean@starlabs.systems>.
• make -s BOARD=<target> echo_modules passed for every Star Labs target in this PR, including starlabs_lite_adl.
• Non-patch-file whitespace check passed with git diff --check ... -- . ':(exclude)patches/**'.
• The raw coreboot patch payload files are excluded from that whitespace check because patch context lines intentionally contain tabs and patch trailers; the existing patch files in this PR have the same property.
• Existing StarLite Mk V CI coverage is retained; GitHub checks will rerun on this updated branch.

Lite ADL porting checklist

• Successful external flash of the CircleCI build, recording the programmer model and voltage.
• Boots successfully after flashing.
• Setting-clock prompt behaves correctly after the initial flash and CMOS battery disconnection.
• Clean boot is detected with no keyring or installed OS, and USB boot is offered.
• Boots from USB.
• OS installation and reboot.
• With no public key but an OS present, OEM Factory Reset is offered and completed with a hardware key.
• After re-ownership, a new HOTP/TOTP secret is generated.
• Wi-Fi works in the installed OS.
• PR0 validation:
  • flashprog -p internal reports the flash unlocked before lock_chip.
  • lock_chip applies PR0.
  • flashprog -p internal reports the flash locked afterwards.

[tlaurion]

~Addresses StarLabsLtd/firmware#104.

Thanks for your contribution @Sean-StarLabs
Could you upload your public key used to sign commits to github so the "unverified" commits warning vanishes?

Will try to review toroughly in next coming days but plate quite full right now. Looks good at first glance!

Meanwhile, would be nice if you added the checklist that can be found at https://github.com/linuxboot/heads-wiki/edit/master/Development/Porting.md and suggest changes there for things you see unfit.

[tlaurion]

Also think/suggest changes you would want to see at https://osresearch.net/Vendors/ (edit this page on github link at bottom of the page)

As well as documenting the same way under https://osresearch.net/Flashing-guides

I will collaborate in those PR as we go!

[tlaurion]

@Sean-StarLabs Love your work here, LGTM.

Checklist needs completion, of course.

Also seen as part of work addressing #2159 that you pushed fixes coreboot side. Tracking with great interest.

You might want to take a look at #2165 and linuxboot/heads-wiki#221

Do you have a timeline for testing?

[tlaurion]

@Sean-StarLabs you might want to add your GPIO work under label https://review.coreboot.org/q/topic:%22intel_gpio_lock%22

[tlaurion]

@Sean-StarLabs you might want to add your GPIO work under label https://review.coreboot.org/q/topic:%22intel_gpio_lock%22

Meanwhile, you can add related unmerged patches needed for your port to be applied to coreboot fork (as you did under patches/coreboot-starlabs_2607) for TPM GPIO reset vuln, if merging upstream stalls and prevents you from going forward (or point modules/coreboot to commits confirmed working on your side).