kernel: GR context-promote bisection modes 4-17 and server-managed-ctxbuf registry variant; complete vgsp rename; docs/tooling refresh

- gsp_phys_booter: GR promote bisection modes 4-17 (two-phase zero-field VA,
  batched entries, hVirtMemory, bare VA, KMD SKIP_CTXBUFFER_ALLOC channel,
  old-interface GPU_INITIALIZE_CTX, FBMEM context buffer, UVM-faithful PA-only,
  PATCH/PM auxiliary promotes, server-managed no-promote path); PATCH/PM
  geometry queries and buffers; pre-boot SET_REGISTRY profile selection
- gsp_phys_gpu: gsp_phys_rmcall_gr_promote clamp 0..17 and gsp_phys_srv_ctxbuf
  parameter; registry image variant with RMSetClientRMAllocatedCtxBuffer=0
- vgsp rename across kernel, scripts, tools and docs (module vgsp.ko,
  /sys/kernel/debug/vgsp/, vgsp-<subsystem>: log prefixes)
- risc-v-gsp-rm-debugger user-facing rename and docs/CI refresh; guest-diag
  tool updates; README/SBOM/install/Makefile sync

Live status: CE ladder and P6 guest-copy forwarding green; GR engine context
commit still open (all promote shapes accepted or cleanly refused; the channel
stays CTXNOTVALID) - see Handoff-vGPU-IO.md Addendum 21 (local).

3 files changed, 10 insertions, 10 deletions

diff --git a/docs/05-operations/02-debugging-and-maintenance-workflows.md b/docs/05-operations/02-debugging-and-maintenance-workflows.md
index b7aab25..cb3ea28 100644
--- a/docs/05-operations/02-debugging-and-maintenance-workflows.md
+++ b/docs/05-operations/02-debugging-and-maintenance-workflows.md
@@ -12,7 +12,7 @@ Three layers, in order of usefulness:
    precisely what it expected and what it got (e.g. UVM's "Tracker entry for
    value N … channel_init()"). Always start here.
 2. **Host module trace** — every RPC and every emulation decision is logged
-   with the `gsp-resman-vfio:` prefix. A full CUDA run produces a few hundred
+   with the `vgsp:` prefix. A full CUDA run produces a few hundred
    lines that reconstruct the object tree and the control battery.
 3. **Memory observation** — when the problem is in memory state (mappings,
    semaphores, pushes), the module's debug parameters read and write guest
@@ -52,13 +52,13 @@ See the host-module doc for the full list. Canonical examples:
 
 ```bash
 # Find where a value lives in guest RAM (e.g. a semaphore VA):
-echo 0x121000000 | sudo tee /sys/module/open_iov_vfio/parameters/scan_guest_ram
+echo 0x121000000 | sudo tee /sys/module/vgsp/parameters/scan_guest_ram
 
 # Find a decoded method sequence in guest RAM:
-echo 0x1,0x21000000,0x1 | sudo tee /sys/module/open_iov_vfio/parameters/scan_seq
+echo 0x1,0x21000000,0x1 | sudo tee /sys/module/vgsp/parameters/scan_seq
 
 # Write a value to a guest physical address (completing a semaphore release):
-echo 0x120299010,0x1 | sudo tee /sys/module/open_iov_vfio/parameters/poke_guest
+echo 0x120299010,0x1 | sudo tee /sys/module/vgsp/parameters/poke_guest
 ```
 
 **Caution:** all guest-RAM operations run in a kernel thread context by design;
@@ -282,7 +282,7 @@ addresses into a new configuration — re-derive per firmware.
   [`../06-portability/hardware-software-matrix.md` §6](../06-portability/hardware-software-matrix.md)).
 * Add the new entry to the runtime signature database in
   `kernel/firmware_analyzer.c` (`known_signatures[]`: version string, hashes,
-  discovered addresses). This is what lets one `open-iov-vfio.ko` identify
+  discovered addresses). This is what lets one `vgsp.ko` identify
   multiple firmware versions safely.
 
 **5. Validate (same checklist every version).**
@@ -380,14 +380,14 @@ ordering; the quickstart and tool chooser are in the
 
 | Symptom | Likely cause | First check |
 |---------|--------------|-------------|
-| `insmod open-iov-vfio.ko: Unknown symbol` | missing prerequisite module (`mdev`) | `modprobe mdev vfio vfio_iommu_type1 vfio_pci` |
+| `insmod vgsp.ko: Unknown symbol` | missing prerequisite module (`mdev`) | `modprobe mdev vfio vfio_iommu_type1 vfio_pci` |
 | mdev create `-EUSERS` | `available_instances` = 0 (leak) | `cat .../available_instances` |
 | Guest: no PCI device | mdev not attached | QEMU command line for `sysfsdev=` |
 | Guest: sees device, probe hangs instantly | BAR0 mmap PFN bug (fixed) | host `make_spte` WARN |
 | Guest: probe hangs, no KVM warning | doorbell/RPC never consumed | host dmesg for the emulation thread and doorbell writes |
 | Guest: RPC processed but driver still waits | MSI-X never delivered | `SET_IRQS wired` line; `irqs[0].trigger` non-NULL |
 | Guest agent dead, QEMU alive | guest kernel wedge | gdbstub vCPU sampling (§3.7) |
-| `rmmod open_iov_vfio` hangs | leaked kthread / open fds | `ps -e \| grep gsp_emu`; mdevs still present? |
+| `rmmod vgsp` hangs | leaked kthread / open fds | `ps -e \| grep gsp_emu`; mdevs still present? |
 | Guest Code 43 / probe fail (Windows) | config space / MSI-X details | config read/write logs |
 | `pr_warn_ratelimited(... not supported in emulation mode)` | guest used a BAR_TRAP/MIGRATE RPC | expected fail-fast; wire a real handler if hot |
 
diff --git a/docs/05-operations/03-risc-v-gsp-rm-vm.md b/docs/05-operations/03-risc-v-gsp-rm-vm.md
index cde0736..a55e3ac 100644
--- a/docs/05-operations/03-risc-v-gsp-rm-vm.md
+++ b/docs/05-operations/03-risc-v-gsp-rm-vm.md
@@ -29,7 +29,7 @@ its runtime behaviour inspectable with Frida-like primitives:
   "execute until here" from the decompiler.
 
 Its stated purpose is **simulating and inspecting the GSP firmware's runtime
-memory for `gsp-rm-vfio` accuracy measurements**: capture how the firmware
+memory for `vgsp` accuracy measurements**: capture how the firmware
 behaves, compare that with the emulation and with the physical backend, and
 survive GSP version/device/architecture churn with repeatable evidence.
 
diff --git a/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md b/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md
index c1ecffe..d16da23 100644
--- a/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md
+++ b/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md
@@ -18,7 +18,7 @@ authoritative details live in the tool's own documentation set
 risc-v-gsp-rm-debugger runs GSP/uproc firmware in a controllable machine, instruments it
 with Frida-like primitives, records a durable session, changes the machine's
 inputs (including injected code), and compares runs so that emulation changes
-in `open-iov-vfio` land with evidence instead of anecdotes.
+in `vgsp` land with evidence instead of anecdotes.
 
 | It is | It is not |
 |---|---|
@@ -363,7 +363,7 @@ audited v0.1 surfaces; treat changes to them as reviewed events.
   gdbstub.
 * **No guest, no hardware, no product.** Nothing runs in a guest; injected
   services are prototypes, not shipped code; product changes go through
-  `open-iov-vfio` with physical confirmation.
+  `vgsp` with physical confirmation.
 * **Read by default; writes gated.** MCP `write_mem`/`call_function` need
   `--allow-write`, injection needs `--allow-inject`, and every write is
   recorded in the session.