ci: add cv200_neo + av100_neo qemu-boot matrix rows

[widgetii]

Summary

Closes OpenIPC/firmware#2123. Now that the firmware nightly publishes openipc.hi3516cv200-nor-neo.tgz and openipc.hi3516av100-nor-neo.tgz (after OpenIPC/firmware#2124 added both boards to the firmware build matrix), wire two new rows into the qemu-boot job.

Local pre-merge validation

Both nightly tarballs were downloaded and exercised against the same smoke harness this PR's CI will use:

hi3516cv200_neo (nightly tarball):
  [PASS] login (openipc-hi3516cv200 login:)
  [PASS] IP (10.0.2.15 via SLIRP DHCP)
  [PASS] ping 10.0.2.2
  [PASS] no Oops/panic/BUG/Call Trace patterns

hi3516av100_neo (nightly tarball):
  [PASS] login (openipc-hi3516av100 login:)
  [PASS] IP (10.0.2.15 via SLIRP DHCP)
  [PASS] ping 10.0.2.2
  [PASS] no Oops/panic/BUG/Call Trace patterns

Row mechanics

New optional variant: field on a row:

• Defaults to lite. Rows that don't set it stay byte-equivalent (download URL openipc.X-nor-lite.tgz, row name unchanged).
• When variant: neo:
  • row name becomes QEMU boot (<machine>_neo)
  • download URL becomes openipc.<machine>-nor-neo.tgz
  • upload-artifact name becomes qemu-boot-<machine>_neo

Real gate, not allow-failure

Both new rows are real gates — no allow-failure: true. load_hisilicon on neo doesn't load HiSi blobs (kernel-version path mismatch — separate firmware follow-up to teach it the /lib/modules/7.0 path), so neither row sets min_modules:; the assertion is "login reached + no error patterns". That's what the local DoD test exercises and what the CI will exercise.

Test plan

• YAML parses cleanly
• Existing lite rows unchanged (variant defaults to lite)
• Local QEMU smoke against published nightly tarballs (cv200_neo, av100_neo): login + DHCP + ping + clean dmesg
• CI exercises both new rows on this PR — must reach SUCCESS before merge (branch protection enforces all 27 required checks)

🤖 Generated with Claude Code