vgsp-gl: sweep the beef ring head for the client's init uploads and quarantine the screen/code-heap overlap

The GL client's one-shot LOAD_INLINE_DATA uploads (code images, vertex
and index buffers) sit at the head of its GPFIFO ring, but the first
observed GP_PUT can already be far past them (r1508: put=8982), so the
continuation sweep never decoded them and the FB fetch pages stayed
zero. Sweep the head once per beef channel in inline-only mode with the
read-arbitrated, tail-aware decoder: r1509 receipts show
'sema-utilsweep swept=64 writes=16' and
'inline write dst=0x44ff000 -> pa=0xb9f000 bytes=1550
data8=9a996940...', after which sema_probe reads the client's real
vertex floats and the u16 index stream at 0xb9d410/0xb9fcc8.

The guest's shader/code-heap BAR1 upload can also land on the captured
X screen's pages (r1508/r1510: vidmem 0x200000 held a program image
while the X screen VA 0x120400000 maps there). Snapshot the captured
surface at bind time; before a launch whose surface page 0 carries the
code-heap/SPH signature, restore the surface from that snapshot (a
black X-clear baseline when the bind happened after the upload). The
quarantine is content-gated, preserves raster stores that follow, and
r1509/r1511 show the clean page 0 (0xff000000) with no code bytes.

0 files changed, 0 insertions, 0 deletions