debug: green-eye wave 2 - injection SDK, Frida-like calls, Ghidra control bridge, long-term docs

Adds to debug/risc-v-gsp-rm-vm/:
- Session.call / run_until: Frida-like remote function calls and run-to-cursor,
  with register restoration; verified live (rpc_ping -> 0xaffe).
- symbol+offset target resolution (gsp_ctrl+0x10) across all APIs and the REPL.
- Injection SDK (sdk/) and 'greeneye inject': position-independent RV64 service
  blobs (verified zero relocations), loaded into RAM, registered in the demo
  handler table, and invoked either directly or through the firmware mailbox
  dispatcher. Demo ABI extended: mailbox 16..23 selects slots, arg0 carries the
  service command, arg2 added (struct now 0x190; schema updated).
- Ghidra control bridge (greeneye ghidra + GreenEyeControl.java): run-until-here,
  breakpoints, memory/register access, remote calls, hit export; verified
  end-to-end with Ghidra headless (run_until reached rpc_sum from a GhidraScript).
- MarkGreenEyeHits.java fixed for the Ghidra 12 createBookmark API; verified
  headless together with ExportForGreenEye.java.
- Analyzer renders a QEMU first-fault table for probe sessions (fault count,
  epc with firmware vaddr translation, access address/size, reason).
- Tests now 35 green, including injection, Ghidra bridge, remote call, run-until
  and REPL command smoke tests.
- Documentation: docs/11-16 (GSP RM service developer guide, injection SDK
  specification, Ghidra control, adversarial interoperability guide, agentic
  GSP IDE, custom simulator design) and GREEN-EYE-ROADMAP.md (long-term H1-H7
  program); doc maps and the project RISC-V VM doc updated.

1 files changed, 28 insertions, 0 deletions

diff --git a/debug/risc-v-gsp-rm-vm/greeneye/analyze.py b/debug/risc-v-gsp-rm-vm/greeneye/analyze.py
index 07c24eb..66429e9 100644
--- a/debug/risc-v-gsp-rm-vm/greeneye/analyze.py
+++ b/debug/risc-v-gsp-rm-vm/greeneye/analyze.py
@@ -110,6 +110,34 @@ def render_summary_from(meta: dict, events: list[dict], symbols=None, max_rows:
         lines.append("* recorder counts: " + ", ".join(f"{k}={v}" for k, v in sorted(counts_meta.items())))
     lines.append("")
 
+    # QEMU exception report (probe sessions)
+    fault_count = meta.get("qemu_fault_count")
+    first = meta.get("qemu_first_fault")
+    if fault_count or first:
+        lines.append("## QEMU exceptions")
+        lines.append("")
+        lines.append(f"* total exceptions: {fault_count if fault_count is not None else '?'}")
+        if meta.get("qemu_log_blob"):
+            lines.append(f"* qemu log blob: `{meta['qemu_log_blob']}`")
+        if first:
+            access = first.get("access") or {}
+            lines.append("")
+            lines.append("| field | value |")
+            lines.append("|---|---|")
+            lines.append(f"| descriptor | `{first.get('desc', '?')}` |")
+            lines.append(f"| cause | `{first.get('cause', 0):#x}` ({_RISCV_CAUSES.get(first.get('cause', 0) & 0xFF, '?')}) |")
+            epc = first.get("epc", 0)
+            bias = meta.get("bias") or 0
+            epc_cell = f"`{epc:#x}`" + (f" (firmware vaddr `{epc - bias:#x}`)" if bias else "")
+            lines.append(f"| epc | {epc_cell} |")
+            lines.append(f"| tval | `{first.get('tval', 0):#x}` |")
+            if access:
+                lines.append(
+                    f"| first access | `{access.get('rw')}` at `{access.get('access_addr', 0):#x}` "
+                    f"({access.get('size')} bytes, reason `{access.get('reason')}`) |"
+                )
+            lines.append("")
+
     def annotate(addr):
         if not isinstance(addr, int):
             return ""