[Audit] handle-lifecycle XELOGKERNEL probes (cvar-gated)

New cvar `audit_handle_lifecycle` (Auditing group, default false).
When enabled, emits one-line XELOGKERNEL traces tagged AUDIT-HLC at:
  NtCreateEvent return, NtSetEvent entry, KeSetEvent entry,
  NtWaitForSingleObjectEx entry + completion,
  EmulateCPInterruptDPC entry.

Observation-only: zero-overhead when cvar off (single branch + flag
read). Intended for handle disambiguation between xenia-rs and
canary under the Wine cross-build oracle.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/xenia/kernel/kernel_state.cc

@@ -15,6 +15,7 @@
 #include "xenia/base/logging.h"
 #include "xenia/emulator.h"
 #include "xenia/hid/input_system.h"
+#include "xenia/kernel/kernel_flags.h"
 #include "xenia/kernel/user_module.h"
 #include "xenia/kernel/util/shim_utils.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_memory.h"
@@ -1372,6 +1373,13 @@ void KernelState::EmulateCPInterruptDPC(uint32_t interrupt_callback,
     return;
   }
 
+  if (cvars::audit_handle_lifecycle) {
+    XELOGKERNEL(
+        "AUDIT-HLC EmulateCPInterruptDPC callback={:08X} data={:08X} source={} "
+        "cpu={}",
+        interrupt_callback, interrupt_callback_data, source, cpu);
+  }
+
   auto thread = kernel::XThread::GetCurrentThread();
   assert_not_null(thread);