vgsp: eng56 - rewrite the window's own slot-1 SPH bind to the authored VTG image, and harden the author window-head decode

- gsp_phys_booter.c: after authoring the VTG SPH at family+0x900, scan the
  patched 3D window for its own 0x2054 slot-1 pair and rewrite an operand
  whose low 12 bits are 0x600/0x300 (client family VA or pair-cache shadow
  line) to <page>|0x900. The window's own later pair otherwise overwrites
  the synthesized prelude j1 and the DS validates the client's SASS page
  (c743: DS-IMAGE st1=0b0b7208). New SPH-SLOT1-REWRITE / SPH-SLOT1 receipts.
- gsp_phys_booter.c: reject an inline VTG candidate whose IMAP word (w6,
  offset 24) is zero; fall back to the builtin image. A 640 B w6=0 record
  authored a zero-map SPH and the DS went to the FECS/PRI sentinel
  (c749 fam 0x4350000: ds 80000000->badf1201).
- gsp_sema_service.c: the DDX ring-head decode scans past zero-payload
  and unreadable entries within the 8-entry bound instead of stopping
  (c746: the ring head is a zero dummy and the C36F release sits later);
  it still never fabricates a payload.

Validation: c749 is the first boot with DS-IMAGE st0=st1=020a0481
(code ff007321, the authored VSA/VSB image), a clean slot-1 rewrite
(old=0x01e00300 new=0x01e00900), beef MME-PACK-REARM, and the DS latch
reduced from 86040626 to 84000420; stores are still 0 and the DRAW_IAB
macro is the next gap.

0 files changed, 0 insertions, 0 deletions