[Subsystem-fixes] 6 verified ours-vs-canary divergence fixes

From the 2026-06-12 5-subsystem differential audit. All verified against
canary as oracle; 660/660 workspace tests green (655 + 5 new).

1. nt_create_event polarity (exports.rs) — `manual_reset = gpr[5] != 0`
   was INVERTED. Canary xboxkrnl_threading.cc:668 `Initialize(!event_type,..)`
   + xevent.cc:41 (type 0 = NotificationEvent = manual, type 1 = Sync = auto).
   Now `== 0`. Was the dormant 2.AI fix on chore/portable-snapshot, never
   merged. The Ke-path was already correct; only the Nt-path was wrong.

2. 2.AF deadline drain (main.rs coord_pre_round) — expired KeWait/KeDelay
   deadlines never fired under load because advance_to_next_wake_if_due was
   only called in coord_idle_advance (no-Ready-threads path). Added a
   per-round drain loop; covers BOTH lockstep and parallel outer loops since
   both call coord_pre_round. Was the dormant 2.AF fix, never merged.

3. handle slab-recycle ABA guard (state.rs + scheduler.rs) — release_handle_slot
   (my round-34 regression) recycled a closed slot even with a thread still
   parked on it, risking a stale-waiter wake when the slot is re-minted. Added
   Scheduler::any_thread_waiting_on; decline to recycle a still-waited slot.

4. vpkpx pixel-pack (vmx.rs) — wrong field mapping (~100% mismatch). Now
   exact canary ppc_emit_altivec.cc:1795 shift/mask (red 6b out[15:10] from
   w[24:19], green out[9:5] from w[14:10], blue out[4:0] from w[7:3]; no
   fabricated alpha bit). +unit test.

5. VFS GDFX attribute plumbing (vfs/*, exports.rs query fns) — VfsEntry now
   carries the real on-disc attribute byte (GDFX dirent +12, canary
   disc_image_device.cc:136/154) instead of inferring directory-ness from
   path shape. Query exports report the real FILE_ATTRIBUTE_* bits. Candidate
   driver of the XamShowDirtyDiscErrorUI gate. +tests.

6. MmGetPhysicalAddress region-aware mirror (exports.rs) — flat 0x1FFFFFFF
   mask missed canary's +0x1000 host_address_offset for 0xE0000000+ mirror
   (memory.cc:2317). Read-only query; proven byte-identical 50M digest. +test.

Investigated and intentionally NOT changed:
- zero-on-recommit: no-op; ours has no region-reuse path (bump allocators,
  free is a stub).
- 32-bit ALU writeback truncation (PPCBUG-020): documented-deliberate; premise
  (MSR.SF=0) is questionable but flipping it is out of scope here.
- KeSetEvent/NtSetEvent return value: ours returns true previous state
  (hardware-faithful); canary returns constant 1 — NOT an ours bug.

sylpheed_n50m golden will need re-baselining (legit behavior change).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/xenia-app/src/main.rs

@@ -2124,6 +2124,27 @@ fn coord_pre_round(
     }
 
     kernel.fire_due_timers();
+    // 2.AF — fire expired wait-deadlines under load. Without this drain,
+    // `advance_to_next_wake_if_due` only runs in `coord_idle_advance` (the
+    // no-Ready-threads path), so a thread whose `KeWait*`/`KeDelay` deadline
+    // expires while other threads keep the scheduler busy sits Blocked
+    // forever (observed: tid=5's 42.95ms deadline unfired 29s+). Drain every
+    // entry whose deadline `<=` the current guest timebase — the same `now`
+    // basis `fire_due_timers` uses, so the two stay in lock-step — and let
+    // `handle_timeout_wake` stamp `STATUS_TIMEOUT` and scrub the waiter from
+    // each handle. `advance_to_next_wake_if_due` pops at most one due wake
+    // per call and returns `None` once the earliest remaining deadline is in
+    // the future, so this loop terminates. Deterministic: `ctx(0).timebase`
+    // is the guest-cycle timebase, not host_ns. This runs in `coord_pre_round`
+    // which both the lockstep and parallel outer loops call every round.
+    loop {
+        let now = kernel.scheduler.ctx(0).timebase;
+        let Some((r, reason)) = kernel.scheduler.advance_to_next_wake_if_due(now)
+        else {
+            break;
+        };
+        kernel.handle_timeout_wake(r, reason);
+    }
     // Graphics-interrupt delivery is no longer done here — see
     // `dispatch_graphics_interrupts`, called from the outer loop with
     // `mem` and `&mut stats` in scope. The audio path still uses the