vgsp-gr: output-footprint retirement wait + two-bank win0 rotation + page hashes

Two independent hardening changes for the per-boot 'all-wrong' class:

1. Output-footprint retirement wait (gsp_phys_gr_output_retire_wait): qmd_rel
   is a schedule/fetch ack, not a data-path retirement - the engine's stores
   into the bounce pages can land after it. Copy-out (and the next launch's
   copy-in) before those stores land loses them: the guest observes zeros
   for a completed launch (matmul csum=0, r146) or stale/mixed content
   (smiley b-into-a, r143/r145). The wait polls up to 300x5 ms, success path
   only, until every page of the output footprint (contiguous descending
   reloc run from the max reloc_va) differs from its copy-in checksum;
   logs 'output retirement wait: N/N pages changed after T ms'.

2. Two-bank win0 rotation: pool grows 8 -> 16 slots (VAs 0x1e0000..0x1effff,
   below the mail-injection slot 0x1f0000), bank selected by submission epoch
   (epoch & 1). A launch's copy into one bank can no longer clobber the
   pages the previous launch's engine index/data fetches may still read.

3. Evidence: full win0 param page dump rows + FNV-1a pre/post hashes of the
   win0 param page and the guest param page, so a torn/mixed read source is
   provable from the log on the next occurrence.

static_asserts: pool < mail slot and SLOTS == 2 x BANK. Build clean.
Live validation pending (next cycle: mail->matmul->smiley->victory_math->
vector_add).

0 files changed, 0 insertions, 0 deletions