Clarify Dogebox-WG ownership of NanoPC-T6 secure-boot PTA client

[Copilot]

The issue was ambiguity around whether Dogebox OS must be the Rockchip secure-boot PTA client and, if an OS-side client is needed, which Dogebox-WG project should own it. This PR tightens the NanoPC-T6 docs to make client responsibility explicit.

• PTA invocation model

  • Clarifies that enabling CFG_RK_SECURE_BOOT=y only exposes the OP-TEE pseudo-TA API.
  • States invocation is explicit (not automatic) and can come from either U-Boot or Linux userspace.

• Dogebox-WG project ownership

  • Adds explicit guidance that OS-side client implementation should live in dogeboxd (or a dogeboxd root helper), aligning with dogeboxd’s host-level orchestration/privileged responsibility.

• Documentation scope

  • Keeps changes localized to NanoPC-T6 secure-boot docs; no runtime/config behavior changes.

Within Dogebox-WG projects, that OS-side client should live in
`dogeboxd` (or a `dogeboxd` root helper), since `dogeboxd` owns host-level
system orchestration and privileged operations.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.