Two cvar-gated AUDIT-HLC probes for thread-spawn lineage attribution:
1. ExCreateThread_entry shim logs (start_address, start_context, xapi,
flags, kernel lr, guest_lr). guest_lr is recovered via the same
one-frame-up PPC back-chain walk used by the NtWaitForSingleObjectEx
probe (lr saved at [back2 - 8]).
2. XThread::Execute emits (tid, start_address, start_context, xapi) at
the very top so each running thread can be matched back to its
creating ExCreateThread entry by (start_address, start_context).
Gated on the existing cvars::audit_handle_lifecycle; no new cvar.
Pulled in xenia/kernel/kernel_flags.h from xthread.cc to expose the
cvar declaration there.
Used by audit-059 round 12 to enumerate the 23 thread spawns in
canary's 35 s boot, attribute each to its guest_lr caller, and cross-
reference against ours' 10 spawns to identify the 7 missing
spawner functions (including sub_824F7800 which spawns the 4 silph
PKEVENT workers at entry=0x82506528/58/88/B8 via guest_lr=0x824F7B24).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
a594f95f77