vgsp-sema: fan pool releases through every published VAS translation

r1647 showed the pool semaphore page can move between the RM memdesc, the
self-discovered directory and the per-client VAS directories. The
first-success walk landed on a stale directory that mapped the pool VA to
the old page (0x2600000) while the guest polled the live page
(0x126502000): the UVM channel-init tracker read 0 and GZDoom spun in
uvm_push_end_and_wait. A manual write to the live page cleared the spin.

Add svc_walk_vaspaces_collect(), which walks one VA through every
registered VAS and returns the distinct translations, and
svc_pool_write_all_vas(), which writes a pool value through each (forward
only, read-back proven, identity and unreadable pages skipped, bounded
log). Pool releases and the tracker-slot fallback now fan out through the
collected translations in addition to the boot primary/secondary
candidates. The counter is forward-only, so a duplicate on a stale
semaphore page is harmless.

Evidence: r1649 (all six UVM channels authored; GZDoom leaves
uvm_spin_loop and advances to the GL client path).

0 files changed, 0 insertions, 0 deletions