vgsp: CE copy completeness + CEAUDIT instrumentation

Trace the CE (copy-engine) data path that services every guest
cudaMemcpy: the guest driver chunks large copies into <=1 MB
LAUNCH_DMA pushes; svc_decode_stream makes one op each and the host
software copy svc_copy executes it (per-256 B bounce, per-page
translation, page-clipped chunks). The hardware-forwarding path only
carries <=4 KB single-page candidates, so it cannot move these.

Completeness verdict: the CE executor is complete-or-error at every
size - the loop copies exactly 'total' or returns an errno (never a
partial success); failures hold the entry (bounded opdef hold, loud
EXPIRED) or are dropped loudly at fwd-ownership. r219 confirms: all 96
audited big copies done==len, zero COPY-MISMATCH, and every CE failure
was a pre-loop resolution miss (rc=-2, no byte moved) - invisible to
the copy-level audit until now.

New instrumentation (all additive, no new locks/waits):

- CEAUDIT per >=32 KB CE op (copy and fill): op/src/dst/len/done/rc,
  successes unconditional (4096/boot budget), rc!=0 repeats rate
  limited; done=0x0 exposes the pre-loop resolution-miss retries.
- CEAUDIT-MISMATCH: the same true start/end 16-byte destination
  readback as COPYAUDIT (moved to the real end sample), emitted next to
  COPY-MISMATCH for ce-soft-copy.
- D2H authority visibility: ledger counters + table-fill diag line
  (sema-svc: ledger n=/stores/evict/diverges/rewrites) and a
  sema-ledger: EVICT warn on the silent home-replacement path.

D2H source verdict (documented in /tmp/opencode/agent-COPY.md): for
pages the launch owns the D2H follows the submit-time ledger landing =
the page the copy-out wrote (correct); it can silently return prior
content for unowned pages (fill-span cuts, work-item drops), on ledger
eviction, and after a failed launch whose copy-out never ran.

make kernel green; only the pre-existing %x warning at
gsp_phys_booter.c:14088.

0 files changed, 0 insertions, 0 deletions