[Audit] round 12: ExCreateThread + XThread::Execute probes

Two cvar-gated AUDIT-HLC probes for thread-spawn lineage attribution:

1. ExCreateThread_entry shim logs (start_address, start_context, xapi,
   flags, kernel lr, guest_lr). guest_lr is recovered via the same
   one-frame-up PPC back-chain walk used by the NtWaitForSingleObjectEx
   probe (lr saved at [back2 - 8]).

2. XThread::Execute emits (tid, start_address, start_context, xapi) at
   the very top so each running thread can be matched back to its
   creating ExCreateThread entry by (start_address, start_context).

Gated on the existing cvars::audit_handle_lifecycle; no new cvar.
Pulled in xenia/kernel/kernel_flags.h from xthread.cc to expose the
cvar declaration there.

Used by audit-059 round 12 to enumerate the 23 thread spawns in
canary's 35 s boot, attribute each to its guest_lr caller, and cross-
reference against ours' 10 spawns to identify the 7 missing
spawner functions (including sub_824F7800 which spawns the 4 silph
PKEVENT workers at entry=0x82506528/58/88/B8 via guest_lr=0x824F7B24).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/xenia/kernel/xthread.cc

@@ -21,6 +21,7 @@
 #include "xenia/base/threading.h"
 #include "xenia/cpu/processor.h"
 #include "xenia/emulator.h"
+#include "xenia/kernel/kernel_flags.h"
 #include "xenia/kernel/kernel_state.h"
 #include "xenia/kernel/user_module.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_threading.h"
@@ -544,6 +545,13 @@ X_STATUS XThread::Terminate(int exit_code) {
 void XThread::Execute() {
   XELOGKERNEL("XThread::Execute thid {} (handle={:08X}, '{}', native={:08X})",
               thread_id_, handle(), thread_name_, thread_->system_id());
+  if (cvars::audit_handle_lifecycle) {
+    XELOGKERNEL(
+        "AUDIT-HLC XThread::Execute tid={} start_address={:08X} "
+        "start_context={:08X} xapi={:08X}",
+        thread_id_, creation_params_.start_address,
+        creation_params_.start_context, creation_params_.xapi_thread_startup);
+  }
   // Let the kernel know we are starting.
   kernel_state()->OnThreadExecute(this);