PLAYBACK used dev_timestamp from the T2 coprocessor clock domain,
which drifts from the host's ktime_get_boottime() after module reload.
This produced wild position values in aaudio_pcm_pointer, triggering
XRUN and a scheduling-while-atomic panic when snd_pcm_do_stop ran
from DMA IRQ context.
Switch PLAYBACK to os_timestamp (host boottime at message receipt),
matching what CAPTURE already does. The mailbox transit delay (~100
microseconds at most) is negligible in a 347 ms ALSA buffer and
eliminates the crash entirely.
