vgsp: verified-VAS tracking + ring-VAS probe (CONT.400)

The beef GR client channel (0xbeef0100) declares hVASpace==0 and its ring
gpfifo=0x4020000 was never resolved (ring_pa=0, rrc=-2) for whole boots, so
the whole GL draw stream was never decoded (black screen, 0.2 FPS).

Root cause chain fixed here:
- svc_chan_vas_candidate_promote returned early because it gated on
  svc_vaspace_known(), and the bounded age-out (sema_vas_cand_ms) had already
  registered the directory UNVERIFIED. It now gates on a new
  svc_vaspace_verified() and keeps retrying by content.
- The age-out no longer clears the parked candidate (it used to consume it),
  so the content-verified upgrade path still has something to walk.
- New 'verified' flag on struct svc_vaspace/sema_vaspace_desc; RM's own
  SET_PAGE_DIRECTORY, the verified ring walk, and the auto-discovered client
  VAS mark it verified; an unverified registration never downgrades a
  verified one.
- New RING-VAS probe: when no parked candidate maps the ring VA, walk every
  registered directory for it and adopt the first that yields a plausible
  entry-0 push.

Result: VAS 0xbeef0300 now registers VERIFIED (was always UNVERIFIED). The
ring VA itself is still not mapped by any registered directory - the guest
never publishes SET_PAGE_DIRECTORY to us; all VASes come from COPY_SERVER_PDES
discovery. Diagnostic added for the next step.

1 files changed, 7 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 7228cd3..6f591e5 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -95,6 +95,13 @@ struct sema_vaspace_desc {
 	u64 pdb;
 	u32 num_entries;
 	bool b_vidmem;
+	/*
+	 * CONT.400: true when the directory was proven against this client's
+	 * own content-validated ring (or published by RM itself). A directory
+	 * registered only by the bounded age-out is UNVERIFIED; a verified
+	 * registration must never be downgraded by a later unverified one.
+	 */
+	bool verified;
 };
 
 void gsp_sema_service_vaspace_add(const struct sema_vaspace_desc *desc);