kmodloader plan: rewrite for the three-path architecture

Reflects what actually shipped, not the original design. Highlights:

- Drops the IOPCIMatch personality plist architecture entirely.
  Phase 1a-c shipped that approach; Phase 1d ripped it out in favor
  of devmatch + linker.hints. Plan now describes the three-path scan
  (devmatch / GPU PCI / kern.vm_guest) as the architecture.
- Documents the AMD radeonkms-vs-amdgpu split via the upstream-frozen
  drm_pciids.h list (RadeonPCIIDs.h) — vendored once, no curation.
- Adds the hypervisor scan path (vbox / vmware) with the matching
  pkglist additions and kern.vm_guest probe.
- Phase 1d/1e/1f/1g marked DONE with what each commit actually
  delivered; Phase 2 (hot-plug via /dev/devctl) marked PLANNED.
- New Phase 3: documents the firmware-from-/boot/firmware/ namei
  issue surfaced by bench testing on the Skylake laptop. Kernel-
  thread context doesn't follow the chroot; firmware files visible
  to userspace aren't visible to firmware_get(). Out of scope for
  kmodloader but tracked here as the next-blocker for fully-automatic
  GPU + WiFi.
- Phase 5 captures the upstream-PR option: get drm-kmod / nvidia-drm-
  kmod to declare MODULE_PNP_INFO so devmatch handles them and Path
  2 collapses or disappears.
- Open questions trimmed: most original ones resolved by the
  three-path pivot. Remaining ones around firmware-namei and
  Phase 2 parsing are now explicit.

Companion to the Phase 1d-1g work in pkgdemon/freebsd-launchd
commits 4c64f18, 5a49c21, cc9fb53, 4c1c04b.

Author: pkgdemon