EchoStretch / kstuff-lite

# kstuff-lite — `1.11-opt`
`1.11-opt` builds on the existing kstuff-lite crypto, FSELF, NPDRM, and loader
work. It reduces UELF/KELF transition cost, makes FPU/CR0 handling safer and
faster, and adds detailed opt-in diagnostics.
## Highlights
- Cached translations for fixed per-CPU kernel objects used on every UELF
 entry, including mappings that cross a physical segment boundary.
- Narrow checked trap-frame and stack reads instead of copying unused frame
 prefixes.
- A single-transition debug-register restore and skipped hardware snapshots
 when the current thread does not own active debug registers.
- A validated, normally fault-free CR0 save/TS-clear chain with mandatory
 per-kernel gadgets and no legacy CR0-capture fallback.
- Fast CR0 entry through a one-shot KELF continuation and deferred CR0 restore
 at the final KELF exit.
- Runtime selection between `XSAVEC` and `XSAVE`, with one-time CPUID/XCR0
 discovery and strict save-area validation.
- Expanded opt-in performance and failure metrics through `KSTUFF_OBS=1`.
- Reuse of the loader's existing kernel pipe by prosper0gdb.
## UELF trap and kernel-memory paths
### Narrow checked frame reads
Trap handlers now read only the portion of a saved stack frame that they use.
`fpkg`, `kekcall`, and utility trap handling use checked tail-copy helpers;
mailbox and syscall paths use checked scalar reads and writes. Where the return
address is already known, FSELF handling updates `RSP` and `RIP` directly
instead of reading the same value from kernel memory again.
This reduces `virt2phys` calls and copied bytes without weakening error
handling. A failed read or write returns `EFAULT` or leaves the request on its
normal fallback path instead of consuming partially read state.
### Fixed mapping caches
The following stable per-CPU objects have cached virtual-to-physical mappings:
- the extended trap frame;
- the `justreturn` frame;
- the current-thread pointer in `pcpu`;
- `TSS.RSP0`;
- the `wrmsr` argument area;
- the CR0 enter and exit continuation slots.
The cache can represent two physical segments, so an object crossing a page or
mapping boundary does not need to fall back on every access. Initialization is
checked, publication is atomic, and an uncached checked copy remains available
if a mapping cannot be cached.
The UELF page-table setup also spells out the user, writable, present, and
large-page flags explicitly. Direct-map entries are not made global, avoiding
unsafe stale TLB translations when switching between the kernel and UELF CR3.
## Crypto dispatch
During classification, the fake key is retrieved once and passed to the XTS or
HMAC handler. This removes the former `has_fake_key()` lookup followed by a
second `get_fake_key()` lookup. XTS and HMAC cache selection also performs one
scan that records both a matching entry and the first free entry.
Unhandled or non-fake messages retain the original kernel path, and linked
message chains are still traversed correctly. Snapshot read failures are
c