vgsp-gr: m156 fail-closed release gate - backend half (witness + deferred release0)

The engine's QMD/channel completion ack is a front-end retirement, not an
execution witness. r155 live evidence: streams2's launch logged
qmd_rel=6/ch_rel=0xc0ffee02 while the retirement wait saw '0/205 pages
changed' on the initial attempt and all three outcome retries; the backend
then returned success and the client read all-zero output (STREAMS
bad=32768). The r152 matmul/smiley boots show the same signature.

For a data-bearing launch (resolved operand pages + working bounce window):

- new param gsp_phys_rmcall_gr_failclosed (default 1) forces release0 to
  the module semaphore (the m64 rel-mod shape), so the engine's ack cannot
  reach the guest's release word before an executor is witnessed;
- when the retirement wait still saw zero writes after the bounded
  retries, the backend returns -EIO instead of success and logs
  'FAIL-CLOSED: ... success withheld', so the sema service can withhold
  the guest release and fail loudly (companion commit).

Set gsp_phys_rmcall_gr_failclosed=0 to restore the historical fail-open
behavior. Build: make -j8 (kernel), green.

1 files changed, 4 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h
index 73b0822..d6981e9 100644
--- a/kernel/gsp_phys_gpu.h
+++ b/kernel/gsp_phys_gpu.h
@@ -369,6 +369,10 @@ int gsp_phys_rmcall_gr_skedrec_value(void);
  * wrong-place engine writes (default 1 = enabled). */
 int gsp_phys_rmcall_gr_nowrite_retry_value(void);
 
+/* m156: withhold a data-bearing forwarded GR launch's completion release
+ * unless the retirement wait observed engine writes (default 1 = enabled). */
+int gsp_phys_rmcall_gr_failclosed_value(void);
+
 /* m73: use host-visible sysmem chunks for V7 instance/RAMFC (m62 shape). */
 int gsp_phys_rmcall_gr_inst_sys_value(void);