vgsp-sema: SESSION 134c rank-aware CE first-submission capture - the rank-blind first-hit latched rank 0's block for rank 1

The SESSION 134 first-submission capture scanned the shadow from offset 0
and took the first ring-shaped page for EVERY CE channel. On the r779 boot
that latched rank 0's block (fb 0x80000, userd 0x90000) for rank 1 as well
(both rows scan_hits=1 latch=1 off=0x80000), so caf0001d's first release was
decoded from rank 0's ring/page (sem word +0 instead of +4) and
stale-dropped (cur=1 already from rank 0's applied release). The client's
rank-1 tracker wait never completed: victory_mail spun at 100% CPU with
pub_calls=0 on three consecutive boots (r777/r778/r779), while the r746-era
module (25523f84) passed the same run on a fresh boot (VADDs OK, STATUS OK).

Fix: try the rank's convention offset (0x80000 + 0x20000 * rank) first,
scan the rest bounded as before, and never accept an offset another CE rank
already latched this session (svc_ce_firstsub_off[], reset per session). A
rank whose block is not in the shadow at the instant stays unlatched for
the regular per-pass CE latch instead of stealing a foreign block.

Verified on r781 (fresh boot, same params xlate=1/util_scan=0/vas_cand_ms
=5000/ce_grace=20000): caf00012 rank0 -> fb 0x80000 upa 0x90000;
caf00001d rank1 -> fb 0xa0000 upa 0xb0000 (correct block, sem +4 applied:
pool-wr va=0x121000004 cur=0 -> val=1 ok); ranks 2-5 -> 0xc0000/0xe0000/
0x100000/0x120000 each +0x10000; r780 (r746 module) control run: same
client PASSED (VADD n=32768 bad=0 checksum=12204516.000000, STATUS OK);
r781 client progressed with pub_calls=185132+ (no spin stall). Also the
Vulkan client's CE channel latched via the classic autopin on r781
(beef0101 -> fb 0x80000, live entry0) - first time in the SESSION 131-134
window - confirming the latch machinery works once the wrong-block
mis-latch no longer poisons the channel.

0 files changed, 0 insertions, 0 deletions