Part of the RISC-V port. Same shape as the arm64 item #13; RISC-V hosts are overwhelmingly DT-booted so filtering is the primary path.

Host generates on every exec:

• /memory@... = current grant; /reserved-memory = ctrl block (no-map) and shared IPI area.
• /cpus: every pool hart the instance may ever own (hot-add later), reg = hartid, riscv,isa-base/riscv,isa-extensions/mmu-type/timebase-frequency copied verbatim from the host node for that hart (a spawn probing an extension the firmware disabled on that hart traps). Only granted harts present at boot; hook the manifest "restrict present mask" logic into setup_smp()/of_parse_and_init_cpus().
• Interrupt controller node(s) with the tenant property and granted source ranges (PLIC/APLIC) or reserved identities (IMSIC); the per-hart riscv,cpu-intc nodes for granted harts.
• Devices: granted PCIe host bridge / platform devices with their interrupts/interrupts-extended intact, IOMMU node dropped and iommus stripped.
• /chosen: bootargs with earlycon=sbi (SBI DBCN is firmware-serialised, so a spawn has a console with zero devices), linux,multikernel-fdt for the manifest, so mk_manifest_populate() runs from setup_arch() after early_init_dt_scan().

Out of scope here: devices whose clock/reset/power-domain/pinctrl providers are host-owned (StarFive, T-Head, SpacemiT SoCs). ACPI RISC-V hosts (RHCT/RIMT/MADT) get DTB synthesis later, as on arm64.