vgsp: extend the live PA acceptance bound to the registered guest-RAM top (svc_pa_max/svc_push_pa_ceiling)

The direct-GL client parks its VAS page directory and push pages in the 4-14
GiB high RAM band while the runtime bound stopped at 10 GiB (param/compile),
so svc_ap_ok rejected every walk read above 10 GiB before vfio_dma_rw could
answer: the client ring walk reported 'L0 read fail' / 'walk rc=-2' on the
one boot the RAM content scan latched the real ring (c296), and the push
bodies stayed unreadable (src=3 window garbage / src=255). svc_pa_max() now
never shrinks below the registered guest-RAM top (sanity-clamped to the scan
max), and svc_push_pa_ceiling() floors on the same live bound. c297 (first
boot with the fix): 'RING-VAS h=0xbeef0100 gpfifo=0x4020000 mapped by VAS
0xbeef0300 (pdb=0x110aae000) -> pa=0x23771f000' and pushdec 'src=4
plausible=1' with the read ceiling witness ceil=0x380000000.

0 files changed, 0 insertions, 0 deletions