vgsp: eng62 - fill missing golden SA entries (slot 34 DRAW_IAB = IR 0x265), default off

The golden overlay writes all 55 slot bodies, but the CALL_MME_MACRO(34)
DRAW_IAB run targets SA[34]; the client's captured SA table only covered
slots 0-11 (c772), so slot 34 resolved to IR 0 (the slot-0 body) and the
macro never produced mac=0x22. Add sema_gl_mme_sa_golden_fill (bool, 0):
for every slot whose client SA entry is missing/zero and whose golden body
exists (kernel/golden-mme-tu104.h golden_mme_tu104_sa[64]), set the SA entry
to the golden body's IR entry (slot 34 = 0x265, 75 words) and mark it
present. Nonzero client entries are never overwritten. Fill runs in the
golden overlay, in the submit path before the stub/call-drop walk, and in
the SA re-arm (the release-carrier path); the release path re-fetches and
emits the filled 0x11c pairs. New MME-GOLDEN sa-fill/sa-census receipts.

c774 proves the fill: `MME-GOLDEN sa-fill slot=34 entry=0x265
(client=missing)`. Enable in params-r1624. Build rc 0; the mac=0x22
validation needs a c772-class release boot.

1 files changed, 11 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index ba1da96..5a1c491 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -630,6 +630,17 @@ bool gsp_sema_gr_surf_recs(u64 *va, u32 *n);
 u64 gsp_sema_mme_sa_get(u32 *entries, u32 n);
 
 /*
+ * Golden SA completion (sema_gl_mme_sa_golden_fill): set the host-side
+ * START-ADDRESS RAM entry for `slot` to `entry` and mark it present, but
+ * only when the client's own table has no usable entry for the slot
+ * (absent, or present with entry 0). Returns true when the entry was
+ * filled, false when a nonzero client entry was kept (or slot out of
+ * range). The GR builder uses it to point the held window's CALL runs at
+ * the golden bodies the pack overlay wrote.
+ */
+bool gsp_sema_mme_sa_fill(u32 slot, u32 entry);
+
+/*
  * SESSION 153-CONTINUED-101: the client's own SET_MME_SHADOW_SCRATCH(0x18)
  * write (method 0x3460) - mmeCodeOGL_C597_SETUP_FIXED_CONST (slot 0) reads
  * shadow scratch 0x18/0xd18 via STATE and emits it as the fixed-function