vgsp: refuse DDX-family garbage USERD candidates (get>put) and bound the speculative CONFIRM jump

Wall (a) garbage-admission fix, validated c190-c194 (rich args + tick):
- svc_gr_ram_userd_scan and the FB shape scan (svc_chan_userd) now refuse
  get > put for the DDX family (svc_userd_ddx_family), dropping the
  entries>1024 exemption that admitted c181's 'put=1 get=288190567' block;
  bounded refusal logs ('RAM scan REFUSES ...', 'userdp ... REFUSES fb ...
  (DDX get>put; c181 garbage class)').
- The pump's speculative CONFIRM bounds a non-wrap DDX (non-kick) forward PUT
  jump to gpfifo_entries/2 (mirrors the wrap bound); a runaway jump like
  c181's 'put 1 -> 1170688059' now falls to the DEFERRED/REJECT ladder
  ('forward PUT jump REFUSED ...'). Kick any-step and wrap paths unchanged;
  SYS/CE/UVM untouched.

Receipts (5 cycles): 146 refusal lines (80 RAM, 66 FB), ZERO huge-jump
confirms (all 16 confirms are real small steps), real blocks serving 25+24
submissions from pristine fb 0x8f0000 and RAM 0x11ae6e000. Residual wall
(a): a same-pass re-probe switch to a frozen lookalike (c190) and a late
'Failed to idle DMA' at 60-130 s of X life; gl_frames still reads black
(px0=0, ~12 s/frame) in the windows it ran (c193/c194).

0 files changed, 0 insertions, 0 deletions