vgsp-sema: carry/decode the class2d kick notification target

The GL client arms its class2d kick channel with SET_NOTIFY_A/B + NOTIFY in
the first GPFIFO entry, then submits short kick pushes (NOTIFY only) that
rely on the target staying programmed in the channel context. Two host
gaps left the short NOTIFY with no address, so no completion was authored
and the client spun in its kick/fence wait:

- a same-handle channel re-registration memset() erased notify2d_va even
  though the guest kept using the target from the previous incarnation;
- the pump's walk seed consumes only the newest entries ending at the live
  PUT, so entry 0 (the arm) could be skipped forever.

Preserve notify2d_va across a same-vgpu, same-handle, same-session
re-registration; fall back to it in the GL kick executor when the section
did not re-arm; decode the skipped head entries (bounded, up to 8) on
discovery and from the pump when the kick-family channel still has no
target; and name a NOTIFY that arrives with no target instead of dropping
it silently.

Evidence: backups/evidence-20261002-victory/r1652..r1655 (kick channel
0xbfef0002, short NOTIFY without SET_NOTIFY, walk seed last_get skipping
entry 0). Not yet observed clearing the GL client's glcore spin.

0 files changed, 0 insertions, 0 deletions