vgsp: eng51 - emit the SPH-BIND stage block (budget fix), admit RT0-bearing draw-synth windows, preserve the last beef push, and default the DS stage-image A/B safe

- gsp_phys_booter.c: the synthesized SPH-BIND stage-block guard
  double-counted the already-emitted raster words (101 > 96), silently
  skipping j0/j2/j4/j5; pre=29 -> pre=84 and the DS stage VAs populate.
  Add the SPH-BIND-STAGE-SKIP receipt.
- gsp_sema_service.c: sema_gl_win_rt0_admit (default 1) admits a beef
  draw-synth window whose FIRST colour-target write is a usable
  surface-class bind (RT0-FIRST-MISS witness); preserve the most recent
  beef push (>=256 B) for the gsp-phys-last-push debugfs dump; skip the
  non-RAM windows in the linear ring scan; fix the MME shadow-RAM index
  shift to (mthd >> 2) & 0xfff.
- gsp_phys_booter.c: sema_gl_sph_vtg600 (default 0) and
  sema_gl_sph_vtg_j1 (default 0) are the stage-image A/B: binding
  family+0x600 poisons the DS (the engine-visible alias shadow there is
  the client's SASS upload), so keep the historical +0x900 zero page
  until a real VTG SPH is authored at an engine-visible VA.
- tools/guest-diag/params-r1624.txt: enable sema_gl_win_rt0_admit.
- wiki/Project-Status.md: 2026-11-15 status (MME chain completes and
  executes DRAW_IAB; DS stage image is the named gate).

1 files changed, 2 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index b40dad2..f2a0777 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -305,6 +305,8 @@ void gsp_sema_service_fwd_gr_stats(u64 *req, u64 *ok, u64 *fallback,
  * emitted the download-state local-memory block).
  */
 const u8 *gsp_sema_init_cap_get(u32 *len, u32 *h, u64 *va, u32 *lmem_seen);
+/* eng51 (CONT.512): the most recent >=4 KiB beef push (direct-GL draw). */
+const u8 *gsp_sema_last_cap_get(u32 *len, u32 *h, u64 *va);
 
 /*
  * Discover and pin GR (compute) channel rings after the CE region of the