r586: demanded staging VAs resolve via the client pagemap; fail-closed at the r543 argument defer cap

Two halves of the staging-pin coverage class (r584/r585 boots):

1. guest_pin_stream demand handler: resolve_va_by_content rejects any VA
   outside the CE pushbuffer window (PB_CE_LO..PB_CE_HI), so the demands
   for the GRFILL dropped staging pages (high client VAs like
   0x703304e00000) were silent no-ops - no pin ever landed and the fills
   kept dropping them. r586 falls back to the client's own pagemap
   (scan_range on the exact page), the same walk the window scans use.

2. vgsp-work: the r543 argument-defer cap expiry now takes the r583
   fail-closed path instead of forwarding: the r585 boot's saxpy was
   forwarded with n_data=969 dropped=7 partial=1 at the cap and read
   stale operands (bad=1047527 csum=130523290); the r584 matmul
   (n_data=2 dropped=18) reached the r564 degenerate refusal. Refuse,
   author the QMD release in software (rel_done latched), consume,
   witness. The dropped pages were demanded first (r585), so the retry
   window had its chance; a launch that would run with unresolved
   operands is never silently forwarded.

0 files changed, 0 insertions, 0 deletions