vgsp: verified-VAS tracking + ring-VAS probe (CONT.400)

The beef GR client channel (0xbeef0100) declares hVASpace==0 and its ring
gpfifo=0x4020000 was never resolved (ring_pa=0, rrc=-2) for whole boots, so
the whole GL draw stream was never decoded (black screen, 0.2 FPS).

Root cause chain fixed here:
- svc_chan_vas_candidate_promote returned early because it gated on
  svc_vaspace_known(), and the bounded age-out (sema_vas_cand_ms) had already
  registered the directory UNVERIFIED. It now gates on a new
  svc_vaspace_verified() and keeps retrying by content.
- The age-out no longer clears the parked candidate (it used to consume it),
  so the content-verified upgrade path still has something to walk.
- New 'verified' flag on struct svc_vaspace/sema_vaspace_desc; RM's own
  SET_PAGE_DIRECTORY, the verified ring walk, and the auto-discovered client
  VAS mark it verified; an unverified registration never downgrades a
  verified one.
- New RING-VAS probe: when no parked candidate maps the ring VA, walk every
  registered directory for it and adopt the first that yields a plausible
  entry-0 push.

Result: VAS 0xbeef0300 now registers VERIFIED (was always UNVERIFIED). The
ring VA itself is still not mapped by any registered directory - the guest
never publishes SET_PAGE_DIRECTORY to us; all VASes come from COPY_SERVER_PDES
discovery. Diagnostic added for the next step.

0 files changed, 0 insertions, 0 deletions