parked-controlsd mode: shut down heavy stack while ignition+park

Adds a second controlsd variant that runs while ignition is on but the
car is in Park. It only listens to CAN and publishes carState — no
model, no planner, no lateral/long control, no actuator commands — so
modeld, locationd, calibrationd, plannerd, radard, paramsd, torqued,
dmonitoring*, soundd, loggerd all stay stopped while parked.

Manager swaps between the two via mutually-exclusive predicates:
  - controlsd_parked: ignition AND not started
  - controlsd (full): started (= ignition AND not_parked)

Thermald owns the swap. It already subscribes to carState; we add a
new onroad condition `not_parked` derived from gearShifter, with a
1.5s hysteresis on going into parked (R/P/D thrash protection) and
zero hysteresis on going out (instant wake on shift to D/R/N). At
boot we assume parked so the heavy stack waits for carState to
confirm gear has actually left Park.

Manager predicates can only see persistent Params, not pandaStates,
so thermald exposes ignition as a new IgnitionOn param (edge-written).
Reverse is treated as not-parked — driver is moving.

Files:
- selfdrive/controls/controlsd_parked.py (new, ~50 lines)
- selfdrive/thermald/thermald.py: not_parked condition + IgnitionOn
- selfdrive/manager/process_config.py: parked_only predicate + entry
- selfdrive/manager/manager.py: seed IgnitionOn=False
- common/params.cc: register IgnitionOn

The full controlsd is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

selfdrive/manager/process_config.py

@@ -43,6 +43,12 @@ def only_onroad(started: bool, params, CP: car.CarParams) -> bool:
 def only_offroad(started, params, CP: car.CarParams) -> bool:
   return not started
 
+# CLEARPILOT: predicate for the parked controlsd variant. Runs while ignition
+# is on but the car is in Park (so started=False because thermald has gated it
+# off). Mutually exclusive with the full controlsd, which uses only_onroad.
+def parked_only(started, params, CP: car.CarParams) -> bool:
+  return params.get_bool("IgnitionOn") and not started
+
 # FrogPilot functions
 def allow_logging(started, params, CP: car.CarParams) -> bool:
   allow_logging = not (params.get_bool("DeviceManagement") and params.get_bool("NoLogging"))
@@ -82,6 +88,11 @@ procs = [
   PythonProcess("calibrationd", "selfdrive.locationd.calibrationd", only_onroad),
   PythonProcess("torqued", "selfdrive.locationd.torqued", only_onroad),
   PythonProcess("controlsd", "selfdrive.controls.controlsd", only_onroad),
+  # CLEARPILOT: lightweight CAN listener that runs while ignition is on and the
+  # car is parked. Publishes carState (so thermald can see gear); does no model,
+  # planner, or actuator work. Manager swaps it out for the full controlsd as
+  # soon as gear leaves Park.
+  PythonProcess("controlsd_parked", "selfdrive.controls.controlsd_parked", parked_only),
   PythonProcess("deleter", "system.loggerd.deleter", always_run),
   PythonProcess("dmonitoringd", "selfdrive.monitoring.dmonitoringd", driverview, enabled=(not PC or WEBCAM)),
   # PythonProcess("qcomgpsd", "system.qcomgpsd.qcomgpsd", qcomgps, enabled=TICI),