vgsp-sema: reachable GR counter publish + injected-pin override at autoreg (FORENSICS-v2 H3 + anomaly 6)

FORENSICS-v2 H3: svc_counter_publish() was reachable only at the end of a
fully pumped channel; when a GR channel's ring or USERD cannot be read the
per-channel loop early-`continue`s above that call (USERD not resolvable,
GP_PUT unreadable), so pub_calls stayed 0 even with all 20 GR counter slots
registered and the client's tracker waiting on them. Duplicate the publish
into the safety-net block at the top of the per-channel loop, next to
svc_counter_autoreg/svc_counter_flush_pending:

  - the value is a real GPFIFO put read from the channel's registered
    USERD; when the USERD is not readable nothing is written, so a guessed
    put can never advance the client past work the pump cannot see;
  - the target is the proof-gated slot registration (injected pin or the
    read-back-validated derive), never an unproven page;
  - the same relay-hold guard as the end-of-pass call applies.

The end-of-pass site now publishes for CE channels only, so a GR pass does
not publish twice.

Anomaly 6: an earlier-derived counter_pa could disagree with a
later-arriving injected pin (r1: derived 0x123a43ff0 vs pin-backed
0x123a28ff0) and nothing re-checked the pin while counter_pa was already
registered - a publish would then advance a page the client never polls.
svc_counter_autoreg() now re-checks the rank's slot against the injected
pin on every pass and re-registers (under chan_lock) on a mismatch, which
also makes the new publish proof-gated through the pin.

Evidence: FORENSICS-v2 H3 + anomaly 6; 11-hostdmesg-v2-r1.log:2429-2714
(20x "not at fb ... probe rc=-11", pub_calls=0, gr_rel=0)."

0 files changed, 0 insertions, 0 deletions