vgsp: never run work for a slot consumed without it (epoch mark + content-hash once gate)

The grace-expiry fake path consumed a held CE entry without marking its
GPFIFO slot as consumed for the put epoch, and the replay guard only ran
while the channel was not deferring. A later pin-batch rewind then
re-read the slot, found no recorded identity, and executed the push's
copies against a staging buffer the client had refilled after the faked
release - a deterministic vadd input shift (a[k] == h_a[k + 2 MB]).

- grace-fake consume path now calls svc_replay_note() before advancing;
- the svc_replay_seen() replay skip is evaluated unconditionally: a slot
  consumed in the current epoch is skipped on every replay, deferral or
  not, until a put wrap clears the mark;
- the once-only identity gate gains a content witness (FNV-1a hash of the
  recorded push bytes): the same entry words with different push content
  is a new push (clients rewrite push buffers in place) and runs its ops
  with a cleared done bitmap; suppression requires identical content;
- snapshot write-back persists the hash array; new drain counter
  reident= counts content-mismatch cancellations;
- the grace window stays at 8 s: a faked entry's work is never run, so
  the hold is that work's only chance (a 2.5 s experiment made red-class
  runs complete with corrupt data instead of timing out).

Verified: module 8e90fc7e..., three consecutive end-to-end acceptance
runs (MAIL + VADD bad=0 checksum=392344090.500000 + STATUS OK).

0 files changed, 0 insertions, 0 deletions