Root cause found (source-level). WindowServer did find the IONDRVFramebuffer on the iGPU: the N-192 log shows Creating FB 1 of 1, then CGXMappedDisplayStart: IOServiceOpen failed(0xe00002c7) (kIOReturnUnsupported), 0 of 1 framebuffers were successfully opened, and WindowServer respawning every ~10 s on a virtual framebuffer.
Why: Apple's IOBootNDRV::fromRegistryEntry (IONDRVSupport, IONDRVFramebuffer.cpp) builds its VRAM descriptor only if the boot console's physical address lies inside one of the device's memory ranges (its PCI BARs). On this Arrow Lake the GOP framebuffer is 0x70800000 = DSM base (stolen memory), outside BAR0 (0x6202000000) and BAR2 (0x6210000000), so no descriptor, no usable framebuffer. On NVIDIA the console sits inside BAR1, which is why dGPU mode works.
Fix being tested: kexts/IGPUConsoleRange (4e5bedb). It probes the iGPU first in the IOFramebuffer category, checks that the console really is this GPU's stolen memory (DSMBASE MMIO 0x1080C0, BAR0 mapped only for that read), appends the console range to the device memory and declines, so Apple's IONDRV probes next and accepts it. Injected through OpenCore so it runs before IONDRV (the auxiliary collection loads at ~60 s, too late). Next boot: Hybrid, NVIDIA off, no NMIntelFB.