vgsp: probe the low-aperture GR ring identity, skip GR holes, widen the pristine-FB scan

The GL client's GR kernel ring lives in the RM low aperture
(0x4000000..0xfffffff) and is not mapped by any published client VAS, so
svc_lookup returns ring_pa=0 and the ring-gated USERD discovery never runs.

- svc_pump_channels: for the 0xbeef0000 GR family, prove the ring content
  with a raw PA==VA read and adopt that identity translation (re-proven
  every pass so the churning ring VA re-resolves).
- ce_fb_scan / svc_gr_ram_userd_scan: treat zero holes as not-a-window for
  the 0xbeef0000 GR family and accept entry VAs inside the SEMA VA window
  even outside the +-2 MB ring window.
- svc_fb_userd_pristine_scan: raise the pristine-FB cap from 32 MiB to
  512 MiB so the 32.5 MiB USERD candidate (0x207fc00) is scanned.

These are defensive and do not by themselves dispatch the guest's real GL
draws (the ring entry format and the missing default VAS are still open);
see handoff CONT.393-CONT.395.

0 files changed, 0 insertions, 0 deletions