debug: green-eye wave 2 - injection SDK, Frida-like calls, Ghidra control bridge, long-term docs

Adds to debug/risc-v-gsp-rm-vm/:
- Session.call / run_until: Frida-like remote function calls and run-to-cursor,
  with register restoration; verified live (rpc_ping -> 0xaffe).
- symbol+offset target resolution (gsp_ctrl+0x10) across all APIs and the REPL.
- Injection SDK (sdk/) and 'greeneye inject': position-independent RV64 service
  blobs (verified zero relocations), loaded into RAM, registered in the demo
  handler table, and invoked either directly or through the firmware mailbox
  dispatcher. Demo ABI extended: mailbox 16..23 selects slots, arg0 carries the
  service command, arg2 added (struct now 0x190; schema updated).
- Ghidra control bridge (greeneye ghidra + GreenEyeControl.java): run-until-here,
  breakpoints, memory/register access, remote calls, hit export; verified
  end-to-end with Ghidra headless (run_until reached rpc_sum from a GhidraScript).
- MarkGreenEyeHits.java fixed for the Ghidra 12 createBookmark API; verified
  headless together with ExportForGreenEye.java.
- Analyzer renders a QEMU first-fault table for probe sessions (fault count,
  epc with firmware vaddr translation, access address/size, reason).
- Tests now 35 green, including injection, Ghidra bridge, remote call, run-until
  and REPL command smoke tests.
- Documentation: docs/11-16 (GSP RM service developer guide, injection SDK
  specification, Ghidra control, adversarial interoperability guide, agentic
  GSP IDE, custom simulator design) and GREEN-EYE-ROADMAP.md (long-term H1-H7
  program); doc maps and the project RISC-V VM doc updated.

1 files changed, 89 insertions, 14 deletions

diff --git a/debug/risc-v-gsp-rm-vm/firmware/uproc_demo/gsp_ctrl.schema.json b/debug/risc-v-gsp-rm-vm/firmware/uproc_demo/gsp_ctrl.schema.json
index ca18f81..e0d6cbc 100644
--- a/debug/risc-v-gsp-rm-vm/firmware/uproc_demo/gsp_ctrl.schema.json
+++ b/debug/risc-v-gsp-rm-vm/firmware/uproc_demo/gsp_ctrl.schema.json
@@ -1,19 +1,94 @@
 {
   "name": "gsp_ctrl",
-  "size": 392,
+  "size": 400,
   "fields": [
-    {"name": "magic",         "offset": 0,   "fmt": "u32", "note": "GSP-like control block magic 0x47535031"},
-    {"name": "version",       "offset": 4,   "fmt": "u32"},
-    {"name": "state",         "offset": 8,   "fmt": "u32", "enum": {"0": "S0", "1": "S1", "2": "S2", "3": "S3"}},
-    {"name": "heartbeat",     "offset": 12,  "fmt": "u32"},
-    {"name": "rpc_count",     "offset": 16,  "fmt": "u64"},
-    {"name": "last_rpc",      "offset": 24,  "fmt": "u64"},
-    {"name": "mailbox",       "offset": 32,  "fmt": "u64", "enum": {"0": "idle", "1": "PING", "2": "ECHO", "3": "FILL", "4": "SUM", "5": "STATE", "6": "FAULT"}},
-    {"name": "arg0",          "offset": 40,  "fmt": "u64"},
-    {"name": "arg1",          "offset": 48,  "fmt": "u64"},
-    {"name": "result",        "offset": 56,  "fmt": "u64"},
-    {"name": "buf",           "offset": 64,  "fmt": "bytes", "size": 256},
-    {"name": "handler_count", "offset": 320, "fmt": "u64"},
-    {"name": "handlers",      "offset": 328, "fmt": "u64", "count": 8}
+    {
+      "name": "magic",
+      "offset": 0,
+      "fmt": "u32",
+      "note": "GSP-like control block magic 0x47535031"
+    },
+    {
+      "name": "version",
+      "offset": 4,
+      "fmt": "u32"
+    },
+    {
+      "name": "state",
+      "offset": 8,
+      "fmt": "u32",
+      "enum": {
+        "0": "S0",
+        "1": "S1",
+        "2": "S2",
+        "3": "S3"
+      }
+    },
+    {
+      "name": "heartbeat",
+      "offset": 12,
+      "fmt": "u32"
+    },
+    {
+      "name": "rpc_count",
+      "offset": 16,
+      "fmt": "u64"
+    },
+    {
+      "name": "last_rpc",
+      "offset": 24,
+      "fmt": "u64"
+    },
+    {
+      "name": "mailbox",
+      "offset": 32,
+      "fmt": "u64",
+      "enum": {
+        "0": "idle",
+        "1": "PING",
+        "2": "ECHO",
+        "3": "FILL",
+        "4": "SUM",
+        "5": "STATE",
+        "6": "FAULT"
+      }
+    },
+    {
+      "name": "arg0",
+      "offset": 40,
+      "fmt": "u64"
+    },
+    {
+      "name": "arg1",
+      "offset": 48,
+      "fmt": "u64"
+    },
+    {
+      "name": "arg2",
+      "offset": 56,
+      "fmt": "u64"
+    },
+    {
+      "name": "result",
+      "offset": 64,
+      "fmt": "u64"
+    },
+    {
+      "name": "buf",
+      "offset": 72,
+      "fmt": "bytes",
+      "size": 256
+    },
+    {
+      "name": "handler_count",
+      "offset": 328,
+      "fmt": "u64"
+    },
+    {
+      "name": "handlers",
+      "offset": 336,
+      "fmt": "u64",
+      "count": 8
+    }
   ]
 }