boot_media/rpi5/config.txt: Pi 5 native boot config (FABRIC-3.md §IV.3 item 6)

Researched against the official raspberrypi.com config.txt reference and one
real, working Pi 5 bare-metal project's own checked-in config.txt
(leopoldch/BatMetal), not assumed from general Pi knowledge:

- kernel=kernel_2712.img, os_check=0, device_tree=bcm2712-rpi-5-b.dtb
- enable_uart=1 added (correction to the item's original text): costs
  nothing when unused, and is the only diagnostic channel that would survive
  a framebuffer failure on the untested mailbox path (rpi5_native_boot.c).
- arm_64bit=1 dropped (correction to the item's original text): confirmed
  inert on Pi 5 by official docs.
- dtparam=pciex1 researched, deliberately omitted with rationale recorded --
  community-reported only, not needed until item 5's re-scoped RP1/PCIe work.
- os_check=0 vs. BatMetal's own config (which omits it) recorded as an open,
  unresolved discrepancy rather than silently picked.

boot_media/rpi5/README.md notes the one remaining gap this exposes:
kernel_2712.img names a file nothing currently builds (item 1's
separate-image build target is still outstanding future work).

Doc-and-config only, no compiled code changed. Three-arch QEMU acceptance
(amd64/aarch64/riscv64, in order) run to confirm non-regression only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

FABRIC-3.md

@@ -442,9 +442,41 @@ blocker for free.
      is a materially larger, higher-blast-radius change than items 1–4 — it touches a file all
      three architectures share and boot through today. Recording the real shape here is this
      pass's own deliverable; building it is future work.
-6. **`config.txt` contents, decided from research**: `kernel=kernel_2712.img` (or `kernel8.img`
-   with `os_check=0` if the Pi-5-specific name isn't used), `arm_64bit=1`, pointing at
-   `bcm2712-rpi-5-b.dtb`.
+6. **`config.txt` contents — DONE, 2026-09-04.** Written to `boot_media/rpi5/config.txt`
+   (new directory — `configs/` is Kconfig defconfigs, `img/` is banners/docs, neither fits).
+   Researched against the official current `config.txt` reference
+   (raspberrypi.com/documentation/computers/config_txt.html) and one real, working Pi 5
+   bare-metal project's own checked-in `config.txt` (`leopoldch/BatMetal`), not assumed from
+   general Pi knowledge. Final contents, with the reasoning as comments in the file itself:
+   - `kernel=kernel_2712.img` — the real Pi-5-specific default filename firmware looks for
+     first (falls back to `kernel8.img` if absent); naming our image this exactly removes
+     ambiguity, so the item's own `kernel8.img`/`os_check=0` fallback alternative wasn't
+     needed.
+   - `os_check=0` — official docs name "bare-metal development" as the explicit use case for
+     this flag. Kept despite BatMetal's own config.txt *not* setting it and still booting —
+     recorded as an open discrepancy rather than silently resolved; no hardware in hand yet to
+     confirm which behavior is actually gated.
+   - `device_tree=bcm2712-rpi-5-b.dtb` — pins the DTB explicitly rather than relying on
+     board-revision auto-selection (confirmed via WebSearch of `config.txt` syntax docs).
+   - `enable_uart=1` — **correction to this item's own original text, which didn't have
+     this.** Added per review: costs nothing when nothing is listening, and is the only
+     diagnostic channel that survives a framebuffer failure on the first real boot (the
+     mailbox framebuffer path, `rpi5_native_boot.c`, has two documented-unverified details
+     and has never run on silicon). Enables the Pi 5's dedicated JST debug UART, not the
+     GPIO 14/15 header (`dtoverlay=uart0`, deliberately left out — needs a USB-serial
+     adapter this HDMI-only bring-up doesn't have). `rpi5_uart_base()` already exists
+     and is currently uncalled — this is the hook a UART fallback console would use.
+   - `arm_64bit=1` — **dropped, correction to this item's own original text.** Official
+     docs: "Models that only support a 64-bit kernel ignore this flag" — confirmed inert on
+     Pi 5, not wrong to include, just meaningless.
+   - `dtparam=pciex1` — researched (BatMetal's own comment: "Required for RP1 access"), not
+     included. Community-reported only, not confirmed against official docs, and surprising
+     if true (RP1 is normally always-on). Not needed yet — item 5's real RP1/PCIe work is
+     still re-scoped, not implemented. Revisit if that work needs it.
+   - `boot_media/rpi5/README.md` also added, noting the one remaining gap this item's
+     `config.txt` exposes but doesn't itself close: `kernel_2712.img` names a file nothing
+     currently builds — item 1's separate-image build target (linking at `0x80000`) is still
+     outstanding future work, same gap that item's own text already flagged.
 
 **Hardware-dependent, after 2026-09-17 (not started until then):**
 7. Build the boot media (SD card: `config.txt`, `bcm2712-rpi-5-b.dtb`, kernel image).