vgsp: verified-VAS tracking + ring-VAS probe (CONT.400)

The beef GR client channel (0xbeef0100) declares hVASpace==0 and its ring
gpfifo=0x4020000 was never resolved (ring_pa=0, rrc=-2) for whole boots, so
the whole GL draw stream was never decoded (black screen, 0.2 FPS).

Root cause chain fixed here:
- svc_chan_vas_candidate_promote returned early because it gated on
  svc_vaspace_known(), and the bounded age-out (sema_vas_cand_ms) had already
  registered the directory UNVERIFIED. It now gates on a new
  svc_vaspace_verified() and keeps retrying by content.
- The age-out no longer clears the parked candidate (it used to consume it),
  so the content-verified upgrade path still has something to walk.
- New 'verified' flag on struct svc_vaspace/sema_vaspace_desc; RM's own
  SET_PAGE_DIRECTORY, the verified ring walk, and the auto-discovered client
  VAS mark it verified; an unverified registration never downgrades a
  verified one.
- New RING-VAS probe: when no parked candidate maps the ring VA, walk every
  registered directory for it and adopt the first that yields a plausible
  entry-0 push.

Result: VAS 0xbeef0300 now registers VERIFIED (was always UNVERIFIED). The
ring VA itself is still not mapped by any registered directory - the guest
never publishes SET_PAGE_DIRECTORY to us; all VASes come from COPY_SERVER_PDES
discovery. Diagnostic added for the next step.

1 files changed, 2 insertions, 0 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index f395ce6..f7e7beb 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -5318,6 +5318,8 @@ static void gsp_rm_handle_set_page_directory(struct gsp_emu_context *ctx,
 		desc.pdb = phys;
 		desc.num_entries = num_entries;
 		desc.b_vidmem = (flags & 0x3) == 0;
+		/* CONT.400: RM's own SET_PAGE_DIRECTORY is authoritative. */
+		desc.verified = true;
 		gsp_sema_service_vaspace_add(&desc);
 
 		/* Show the first entries of the directory: they are the ground