vt: don't strand stale inverse cursor cells on scroll/clear

The cursor was blitted as an inverse-video cell directly onto the
framebuffer, but that inversion was never recorded.  RENDERED (the
diff grid) only stored the logical cell, so when scrolling shifted the
raw pixels up (gop::shift_up), the stale inverse block rode along
while the grids said 'blank' — and blank-vs-blank never re-blits.
Result: a cursor-shaped block at the end of every scrolled line,
surviving even 'clear'.

- flush() now mirrors the inverse colours into RENDERED when drawing
  the cursor (and restores RENDERED when erasing it), and the diff
  loop skips the visible cursor cell (owned by the cursor pass).
  Any scroll/clear then sees CELLS != RENDERED at a stale-inverse
  position and repaints it.

- memory.rs heap self-test: snapshot heap state before its own
  allocations and assert the heap returns to that state, instead of
  asserting it coalesces to a single empty block.  The vt cell grids
  (allocated earlier in boot) made the old 'free_blocks == 1' check
  fail; the new check is correct regardless of prior live allocations.

Verified in QEMU: hexdump /dev/mem streams hundreds of lines, ^C,
screendump shows exactly one inverse cell (the live cursor); 'clear'
leaves exactly one (the fresh prompt cursor).  heap self-test OK again.

1 files changed, 3 insertions, 1 deletions

diff --git a/CONTEXT.md b/CONTEXT.md
index 20c60f7..a1ef4bb 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -106,7 +106,9 @@ Single Rust crate (`x86_64-unknown-uefi` target).  Module breakdown:
 - `vt.rs` — terminal emulator: cell grid, cursor, ANSI CSI parser (H/J/K,
   cursor moves, SGR 16-colour, `?25l/h`), dirty-cell blitting, UTF-8
   decoding (box-drawing `│`/`═`, arrows `←↑→↓`, em dash `—` render
-  procedurally instead of `?`)
+  procedurally instead of `?`).  The inverse cursor is mirrored into the
+  rendered grid so scrolling / `clear` can never strand stale inverse
+  cells on the framebuffer.
 - `tty.rs` — line discipline: canonical `read_line` (echo, line buffer,
   ^C/^D) and raw `read_byte` (terminal byte protocol: arrows → `ESC [ A–D`,
   ^X → `0x18`, …)