Simulate RISC-V with the most CPU extensions than we can get

[dinosaure]

We actually needs a certain extension for mirage-crypto to be able to initiate correcty our Fortuna engine. This extension is ZKR and this patch should allows us to have such extension. We can also just use -cpu rv64,zkr=on if you prefer.

[mtelvers]

obuilder with QEMU can be deployed in several ways:

1. Run a QEMU VM and use obuilder's native support with runc and BTRFS. Snapshots are layered filesystem snapshots. This works for any OS that supports a native obuilder backend: Linux/runc, FreeBSD/jail, Windows/HCS.
2. Run each obuilder step using an emulated QEMU VM. Snapshots on disk are layered qcow2 files. This works for any OS we can SSH into and is currently how OpenBSD support is provided.

Currently, OCaml-CI uses a pool linux-riscv64 that includes a mix of real hardware and QEMU-emulated machines, primarily driven by Scaleway's hardware issues. The VMs are deployed with https://github.com/mtelvers/riscv_worker.

• The emulated workers (the bulk of the pool): 30 x QEMU riscv64 under TCG, -cpu rva23s64 — the RVA23 profile, matching what Ubuntu 26.04 targets.
• Physical workers: real riscv64 hardware that doesn't even meet RVA23, so the newest Ubuntu it runs is 24.04 and is the upper bound on what we currently test.

On the emulated side, enabling -cpu max (as per this PR) or the narrower -cpu rva23s64,zkr=on breaks the boot: U-Boot aborts early with initcall sequence ... failed (err=-28). It's the distro U-Boot — Ubuntu 22.04's u-boot-qemu (2022.01): plain rva23s64 boots, but the larger device-tree ISA string from the extra extensions overflows its FDT buffer.

Cross-building a current U-Boot (v2026.07) fixes it — both -cpu max and rva23s64,zkr=on then boot cleanly, no err=-28. Recipe/commit: mtelvers/riscv_worker@fd20055

So -cpu max is workable for emulation, when the host U-Boot is new enough. It's worth noting, though, that actual RVA23 hardware is pretty scarce and that Zkr is an optional extension. I couldn't see any real hardware which supports this combination.

Let me know if you merge mirage/mirage-crypto#283, and I'll update these machines. However, the CI will randomly allocate you real hardware, in which case your test will fail.