Camera dead after every S4 hibernate (Dell Pro Max 14, Synaptics SVP7500 usbio): sensor probe defers on missing ipu_bridge fwnode endpoint; isys_notifier_init crash on rebuild

## Camera dead after every S4 hibernate (Dell Pro Max 14, Synaptics SVP7500 usbio bridge) — sensor probe defers on missing ipu_bridge fwnode endpoint; ipu6 stack rebuild crashes

**Same symptom class as #407** (camera works after suspend, dead after hibernate), but on the **usbio/Synaptics SVP7500** path instead of LJCA/mei — with the failure chain traced to specific kernel components.

### Hardware / software
- Laptop: **Dell Pro Max 14 Premium MA14250**, BIOS 1.9.0, Fedora 44
- Bridge: **Synaptics SVP7500 USBIO** (`06cb:0701`) on xhci port 3-8, hosting i2c clients: `INTC10E0` (intel_cvs), `OVTI08F4` (ov08x40 sensor), `HIMX1092`
- Sensor: **OV08x40** (`OVTI08F4:00`) behind `usbio.usbio-i2c.1` / i2c-3
- Kernels tested: **7.1.13-200.fc44** and **7.2.4-200.fc44** (in-tree `intel_ipu6*` is what is loaded; the akmod in extra/ is shadowed)
- Userspace: ipu6-camera-hal / v4l2-relayd (`icamerasrc` → v4l2loopback)

### Symptom
After **every** S4 hibernate/resume the camera is dead (0 frames from the relay device). Suspend-to-idle is fine. Only a full reboot recovers it. The in-userspace HAL then reports `No attached camera shared memory` / `camera open num couldn't be 0`, i.e. zero cameras enumerated.

### Root-cause chain (all reproducible)
1. **S4 resume destroys and re-creates the usbio i2c clients.** `cvs_common_remove` + re-probe of `INTC10E0` is visible every resume; the `OVTI08F4:00` client also gets deleted/re-created.
2. **ov08x40 probe then defers forever** — `/sys/kernel/debug/devices_deferred`:
```
i2c-OVTI08F4:00 ov08x40: waiting for fwnode graph endpoint
i2c-INTC10E0:00 Intel CVS driver: Do deferred probing as request gpiod failed (7.2.4)
```
i.e. the **ipu_bridge fwnode graph endpoint for the sensor is not restored** when the usbio client is re-created after S4. Cold boot works fine (`Found supported sensor OVTI08F4:00`, `Connected 1 cameras`).
3. **Rebuilding the ipu6 stack to re-register the notifier crashes deterministically:**
- 7.1.13: kernel **oops in `isys_notifier_init+0xc0/0x1c0`** (`isys_register_devices+0x3ec`, `isys_probe+0x3a3`), reproducible on every `modprobe intel_ipu6_isys` after teardown (with or without the sensor bound).
- 7.2.4: **soft lockup** — `watchdog: BUG: soft lockup - CPU#14 stuck for 26s! [(udev-worker)]` at the same `modprobe intel_ipu6_isys` step.
4. The media graph keeps the isys entities but loses the sensor entity when the client dies; a bound-but-deferred ov08x40 never registers its subdev, so nothing re-links without the crashing rebuild.

### On 7.1.13 additionally (fixed in 7.2.4)
`usbio-bridge 3-8:1.0: USB control out failed: -71` → `probe with driver usbio-bridge failed with error -71` → disconnect/re-enumerate cycles at every resume; stuck bulk-in URBs (`Bulk in error -108` on teardown). These went away on 7.2.4 — the recent usbio fixes (`disconnect UAF in client teardown`, bulk-IN length bounds) work; the bridge no longer flaps. The graph/defer/rebuild-crash part remains.

### Workarounds tried (none recovers the camera without reboot)
v4l2-relayd restart; HAL SysV IPC cleanup; `intel_cvs` reload; `intel_vpu` reload; `ov08x40` sysfs rebind (probe defers or `-EIO` while the bridge is wedged); USB unbind/bind of the bridge (restores bridge health, sensor binds, **but media graph still never re-links**); `power/persist=1` (already set); USB autosuspend off (already); `power/wakeup=enabled` (doesn't survive the disconnect); module reload of the ipu6 stack (crashes, see above).

### Expected
Sensor/graph/HAL state restored after S4 resume, like after S3. As a minimum, no defer forever and no crash when re-registering the isys notifier.

### Notes for maintainers
- The deferral (`waiting for fwnode graph endpoint`) suggests the ipu_bridge graph built at boot is not re-created for usbio-recreated clients; possibly its endpoint software-node is tied to the original client device.
- The rebuild crash is 100% reproducible and separate from the hibernate path: after unloading `intel_ipu6_isys/psys/intel_ipu6/ipu_bridge` once, any re-probe of isys dies in `isys_notifier_init` — also on 7.2.4 with `abb1f808` included, so the notifier re-probe path is still unsafe.
- Related: #407 (same symptom, LJCA path) and the S4 workaround overlay in LP#2166564 (mei-vsc path), which shows the resume path needs explicit power-loss handling.
- Full journals (kernel log for boot, hibernate entry, resume, hook, both crash traces) available on request; happy to test patches.

Reporter: owner of the affected machine; analysis assisted by an AI debugging session (all claims verified against live sysfs/journal).

Start by reproducing S4 resume and checking devices_deferred for ov08x40, then inspect the ov08x40 probe and ipu_bridge fwnode graph setup as the recreated usbio I2C clients appear. Separately reproduce the intel_ipu6_isys modprobe failure and trace isys_notifier_init during notifier re-registration. Done means the sensor does not defer, the media graph relinks, the HAL sees one camera, and rebuilding isys does not crash.

Written by the indexing model from the issue text.