feat(kernel): KRNBUG-XAM-001 — XGetAVPack returns 8 (HDMI), not 0x16

Mirrors canary's cvars::avpack default (xam_info.cc:35) and Sylpheed's
accepted set {3,4,6,8} (xam_info.cc:250-251). With KRNBUG-XEX-001 having
flipped the priv-10 gate, XGetAVPack now reaches its caller in
sub_824AB578; returning 0x16 caused Sylpheed to abort the AV/crypto
block before XeCryptSha. Cascade walks one step (canary-only export
list 11 → 10); sub_824ABA98 is the next candidate.

Tests: 589 → 590. Goldens re-baselined (n50m: 50000005→50000004,
imports 407417→407416). Lockstep deterministic across 3 reruns at
-n 100M (instructions=100000010, import_calls=987686 +2.4×, swaps=2).
9-PC producer probe still 0×; parked handles 0x1004/0x100c/0x15e0
still signal_attempts=0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/xenia-app/tests/golden/sylpheed_n2m.json

@@ -1,6 +1,6 @@
 {
-  "instructions": 2000000,
-  "imports": 5636,
+  "instructions": 2000005,
+  "imports": 5635,
   "unimpl": 0,
   "draws": 0,
   "swaps": 0,

crates/xenia-app/tests/golden/sylpheed_n50m.json

@@ -1,6 +1,6 @@
 {
-  "instructions": 50000005,
-  "imports": 407417,
+  "instructions": 50000004,
+  "imports": 407416,
   "unimpl": 0,
   "draws": 0,
   "swaps": 2,

crates/xenia-kernel/src/xam.rs

@@ -380,7 +380,7 @@ fn xam_session_create_handle(ctx: &mut PpcContext, mem: &GuestMemory, state: &mu
 // ===== Locale =====
 
 fn xget_avpack(ctx: &mut PpcContext, _mem: &GuestMemory, _state: &mut KernelState) {
-    ctx.gpr[3] = 0x16; // HDMI
+    ctx.gpr[3] = 8;
 }
 
 fn xget_game_region(ctx: &mut PpcContext, _mem: &GuestMemory, _state: &mut KernelState) {
@@ -465,4 +465,11 @@ mod tests {
             other => panic!("expected Thread object with hw_id set, got {:?}", other),
         }
     }
+
+    #[test]
+    fn xget_avpack_returns_hdmi() {
+        let (mut ctx, mem, mut state) = fresh();
+        xget_avpack(&mut ctx, &mem, &mut state);
+        assert_eq!(ctx.gpr[3], 8);
+    }
 }