sema: per-push release/ops summary; never run work from rescued pages

Log one line per ring-decoded push (channel, engine, length, op-run
count, decoded release VA/payload, last 24 bytes) to make the
push->tracker path observable; it showed that the content rescue had
been pinning unrelated RAM pages: pushes of length 4196/8500/12700 whose
tails are RISC-V code (ecall/jal) - GSP firmware or other code pages whose
bytes matched the expected release pattern. Those pages decode as
plausible but bogus method streams, so work executed from them can write
garbage into vidmem. Rescued pages now apply the release only
(allow_ops=false); work requires a page read through a trusted
translation.

0 files changed, 0 insertions, 0 deletions