sema-svc: GR counter slots only from injected pins; route GR releases through the exact slot

Live evidence: with the counter page pinned, counter_pa still resolved to a
stale self-discovered page, so every release write went to memory the client
never polls (host read back its own 1s; client's page stayed 0) and the
client's context-init wait expired. The generic release path could also write
through that stale translation.

- svc_counter_autoreg / svc_counter_learn trust only the injected-pin table
  (svc_ipin_lookup); learn re-registers when the injected PA differs.
- Releases whose target is in the GR counter VA range skip the generic
  translation write entirely and go through the injected-pin-backed slot.

0 files changed, 0 insertions, 0 deletions