vgsp: pdb neighbourhood discovery + injected shared-surface pin sync

- when a content-verified ring pair is known, also scan a bounded window
  around every COPY_SERVER_PDES candidate pdb for a root that reproduces the
  pair; register the found root under the candidate's VAS handle so the
  channel's own VAS lookup resolves the ring even when the offered pdb is a
  stale incarnation
- the periodic shared-surface watchdog now also honours an operator-injected
  shared-surface pin (sema_map_add): read lastKickoffRefCount at +0x880 and
  author it into gpuRefCount at +0x800, forward-only and validated

Live receipt (r1780 c14): with the strict shared-surface signature page
injected, the pin sync advanced gpuRefCount 1420471 -> 1420488 (== lkr), the
DDX idle warning did not repeat, and GZDoom reached V_Init with X alive. Next
walls observed: the DDX push-buffer idle wait (W2) at teardown and a guest OOM
that kills gzdoom.

0 files changed, 0 insertions, 0 deletions