Peugeot 308 T9 (2018): add dashcam-only support

[polo2169]

Adds initial dashcam-only support for the 2018 Peugeot 308 II T9 (facelift),
based on captures from one vehicle with conventional cruise control. The T9
uses a dedicated receive-only DBC and CarState instead of the existing PSA R3
signal mapping. Identification uses the observed CAN ID/DLC fingerprint.

The platform is dashcamOnly with SafetyModel.noOutput, longitudinal control
disabled, and a controller that returns no CAN messages and zero applied
actuators regardless of requested activation. This does not change openpilot's
generic firmware-query stage before car identification. There are no new safety
hooks, actuation messages, HIL profiles or experimental control gains.

The DBC contains ten messages needed for vehicle state. PSA checksum seeds are
extended for the observed 0x3AD and 0x3CD protections. Two two-second RX
fixtures (2,260 frames) retain original payloads and relative timing; provenance
and hashes are included. The export excludes VIN, GPS, diagnostic traffic and
session metadata. Complete-source fingerprint checks covered 830,342 RX live
frames across the two captures, with no ID/DLC mismatch after excluding OBD
diagnostic IDs.

This is an early draft for review of the decoding and port structure. No comma
route is available yet; the platform is explicitly listed in non_tested_cars
until one is supplied. The physical comma harness/bus mapping, firmware
fingerprinting and vehicle geometry still need validation. Driver torque is
in raw units. The forward/Park/Neutral gear field is omitted because the former
candidate in 0x348 remains zero even in the moving capture. Only the independent
reverse indication is decoded. Lateral parameters are inert placeholders, not
an EPS calibration. Coverage is limited to the reference 2018 configuration.

Validation

• Dongle ID: not supplied.
• Route: pending; ESP32 RX fixtures are not a substitute for a comma route.
• Local selected suites: 821 tests run, 646 passed, 175 skipped by the upstream
  suites. Covers T9 replay and no-output behavior, all car interfaces, CAN
  fingerprints, docs/platforms/routes, lateral limits, CAN parsing/checksums,
  existing PSA safety and default safety modes.
• Negative cases: every single-bit corruption in the three protected messages,
  repeated counters, wrong bus, stream expiry, and all activation combinations
  with and without received CAN.
• ruff check ., ty check, codespell, uv lock --check, and
  git diff --check passed. Generated docs/CARS.md is included.
• GitHub CI passed on commit 853001dc: Linux/macOS ./test.sh, safety,
  safety mutation tests on both platforms, all four model-test groups and car
  diff. The car behavior report detected no changes to existing routes.
• A comma route for this T9 and hardware validation remain pending.

[github-actions]

Car behavior report

Replays driving segments through this PR and compares the behavior to master.
Please review any changes carefully to ensure they are expected.

✅ No changes detected

[github-actions]

Thanks for contributing to opendbc! In order for us to review your PR as quickly as possible, check the following:

• Convert your PR to a draft unless it's ready to review
• Read the contributing docs
• Before marking as "ready for review", ensure:
  • the goal is clearly stated in the description
  • all the tests are passing
  • include a route or your device' dongle ID if relevant