r496j VAS candidates are registered only after a content-verified ring walk (+3 fixes)

The r496g blast registration of every COPY_SERVER_PDES directory let a
stale kernel directory answer another client's VA in the walker's
first-success order (the r459 stale-directory class) - measured as a CUDA
client hanging after DEVICE. Candidates are now parked and registered only
when a walk of the client's own content-validated ring VA through them
reproduces that ring's PA; the r496f vidmem sweep remains as a fallback.

Also in this batch:
- svc_chan_userd's VRAM shape scan now prefers a block with work PENDING
  (get < put) and then the one nearest the registered memdesc offset: on a
  channel re-registration the stale previous USERD still validates (it
  holds the same put/entry values) and the old first-match adoption made
  the pump write GP_GET into the dead block (r504 second DMA init).
- The USERD/FB scan and the CE caps byte-1 BL bits (r496i) are unchanged;
  TU104_CE_CAPS1 = 0x03 needs the CUDA battery re-verification.

0 files changed, 0 insertions, 0 deletions