[WIP] Audio/threading fixes + crash investigation; NEW ORACLE: crash is ours not the game

Snapshot for handoff. Contains the mission-audio + threading fixes and the
crash-investigation instrumentation (all diagnostic cvars default-OFF).

Fixes (behavioral):
- threading_posix.cc: reap-once guard on PosixCondition<Thread>::post_execution
  (double pthread_join at mission teardown -> fault loop -> audio death + freeze).
- xma_decoder.cc: work_event_->Set() in Pause() so the idle XMA worker observes
  paused_ and signals pause_fence_ (Pause() deadlock -> permanent audio death).
- audio_system / xma_context_master / xboxkrnl_audio / apu_flags / alsa: mission
  audio keepalive + guest_audio_flags + watchdogs.

Instrumentation (additive, default-off): xboxkrnl_debug cache-throw diag +
guest-catch dispatcher, xex_module PE/PDATA/EH scans, kernel_state mem_watch
(NOTE: mem_watch DEFAULTS TRUE -- an always-on host poll thread; prime crash suspect).

NEW ORACLE (see HANDOFF-crash-oracle-2026-07-16.md): stock 6e5b8324f built with
our toolchain + zero custom code = NO crash, NO sound-stop, plays the Ready Room.
=> the Ready-Room out_of_range crash is introduced by THESE changes, not the game
and not the (LTO-broken) build chain. Bisection plan + suspect ranking in the note.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/xenia/kernel/xboxkrnl/xboxkrnl_audio.cc

@@ -7,7 +7,9 @@
  ******************************************************************************
  */
 
+#include "xenia/apu/apu_flags.h"
 #include "xenia/apu/audio_system.h"
+#include "xenia/base/logging.h"
 #include "xenia/emulator.h"
 #include "xenia/kernel/kernel_state.h"
 #include "xenia/kernel/util/shim_utils.h"
@@ -55,8 +57,13 @@ DECLARE_XBOXKRNL_EXPORT2(XAudioGetVoiceCategoryVolume, kAudio, kStub,
 dword_result_t XAudioEnableDucker_entry(dword_t unk) { return X_ERROR_SUCCESS; }
 DECLARE_XBOXKRNL_EXPORT1(XAudioEnableDucker, kAudio, kStub);
 
-dword_result_t XAudioRegisterRenderDriverClient_entry(lpdword_t callback_ptr,
-                                                      lpdword_t driver_ptr) {
+dword_result_t XAudioRegisterRenderDriverClient_entry(
+    lpdword_t callback_ptr, lpdword_t driver_ptr,
+    const ppc_context_t& ppc_context) {
+  if (cvars::audio_watchdog) {
+    XELOGW("AUDIO-WD guest called XAudioRegisterRenderDriverClient lr={:08X}",
+           static_cast<uint32_t>(ppc_context->lr));
+  }
   if (!callback_ptr) {
     return X_E_INVALIDARG;
   }
@@ -84,9 +91,17 @@ DECLARE_XBOXKRNL_EXPORT1(XAudioRegisterRenderDriverClient, kAudio,
                          kImplemented);
 
 dword_result_t XAudioUnregisterRenderDriverClient_entry(
-    lpunknown_t driver_ptr) {
+    lpunknown_t driver_ptr, const ppc_context_t& ppc_context) {
   assert_true((driver_ptr.guest_address() & 0xFFFF0000) == 0x41550000);
 
+  // Who tore audio down? The guest's return address names the game code path
+  // (resolve with zq.py fn <lr>) -- the game only does this on its own error /
+  // teardown logic, which is what we are hunting. Diagnostics only.
+  if (cvars::audio_watchdog) {
+    XELOGW("AUDIO-WD guest called XAudioUnregisterRenderDriverClient lr={:08X}",
+           static_cast<uint32_t>(ppc_context->lr));
+  }
+
   auto audio_system = kernel_state()->emulator()->audio_system();
   audio_system->UnregisterClient(driver_ptr.guest_address() & 0x0000FFFF);
   return X_ERROR_SUCCESS;