vgsp: GR forwarding static-review fixes (GR/CE slot bit, release VA->PA, shadow refusal)

Five defects found in a static review of the default-off GR forwarding path
(no hardware test possible; GPU wedged):

- clear the shared request slot's GR mode bit when a CE request is filled,
  so a prior GR request can never make a later CE push run the GR work
  function with stale fields;
- resolve the QMD release0 guest VA to a guest PA on the service thread
  (counter pin/derive, else the trusted resolver) and only convert PA->HPA
  in the work item; the previous code fed the VA to the PA-based translator
  and would write release0 into an unrelated guest page;
- take the refusal path (goto gr_page_unmapped) on every Tier-2 shadow
  failure instead of continuing to submit a half-built method stream;
- consume the QMD run on replay passes when the GR forward is enabled so
  replayed QMD words are never reinterpreted as CE method headers;
- only queue a captured GR candidate against the channel that captured it.

Build clean (make -C kernel, W=1 only pre-existing warnings).

0 files changed, 0 insertions, 0 deletions