guest-diag: heal session-flush pin wipes with periodic full CE re-assert

The host wipes its whole sema map when the previous client's last channel
closes ('session flush (all channels closed)'). A pin batch that raced in
for the new client (observed: the 1-page 0x120000000 pin emitted in the
same second as the flush) was lost, and the scanner's content-gated delta
never re-emitted the unchanged pairs - so the second client's CE pushes
were permanently unreadable (sema-probe 'NO ENTRY for page 0x120000000'),
every GPFIFO entry was grace-skipped (r144/r145 matmul and mail stalls),
and the guest spun in uvm_tracker_wait_for_entry.

Fix (scanner, guest side):
- _ce_mem_pages: walk the whole vmalloc area (minus header off), not the
  size-derived prefix that stopped one page short of the write frontier.
- _emit_ce_mem_delta: full re-assert mode every KC_FULLREM_S (1.5 s) plus
  every fresh_map pass; emits every translatable pair content-independent,
  merged into contiguous runs. Zero-content pages are pinned on purpose:
  the pin carries the translation, the host reads live content.
- missing pages retried with the negative PA cache popped (bounded 512/pass).

Fix (host tool):
- pin_gr_stream._flush: never dedupe single-page repeats of the CE window
  (0x120000000..0x121000000) so the re-asserts land.

Live-validated in r145 (same-boot, no rebuild): mail green as 4th client,
matmul green as 2nd client (bad=0, 64-changed acceptance of 857fe5f9),
both with zero 'stalled VA'/'skipping stale entry' lines; pre-fix the same
sequences stalled. Headless smiley all-wrong (bad=131072) reproduced
independently and is the next target (engine-side constant class).

0 files changed, 0 insertions, 0 deletions