vgsp: add sema_draw_census - bounded draw-marker census over every client push (eng26 instrument)

One green cycle must answer 'which push carries the direct-GL draw'. The
census scans every non-engine push with the canonical op/cnt run grammar and
logs one bounded row per push containing any draw-family method id (BEGIN
0x1618, END 0x1614, VA_START 0xd74, DRAW_VERTEX_ARRAY 0xd78, index
0x17c8/0x17d8/0x17e0, draw list 0x1b0, vertex streams 0x1c00/0x1c10), with
the hit's word index inside its run so a run that merely NUMERICALLY spans a
method address is distinguishable from a real method data word. Beef pushes
without hits are enumerated once per (va,len) so the cycle yields a full push
inventory. Module param sema_draw_census (default 0), 256 hit + 256 push rows,
read-only.

Live result (c346): full beef push inventory captured; every marker 'hit' is
a k>0 lattice artifact of a data blob (e.g. the 59580-B push's single m=0 run
at off=0x78 covers 0x1b0..0x1c10 at fixed word indices, and its BEGIN-address
word value changes between reads - 0x00058202 then 0x01047220), i.e. no push
carries a real draw method stream. Companion to a4215afa; docs in CONT.487.

0 files changed, 0 insertions, 0 deletions