rsnix v0.5.2: fault diagnostics + real-hardware scroll-crash hardening

The real-hardware scroll crash (white bands + instant freeze, QEMU-clean)
was invisible because the only trace was a single serial line on machines
with no serial console.  This makes every crash self-identifying and
hardens the real-hardware failure surfaces:

- Every CPU exception vector 0-31 now has an IDT entry (macro-generated
  stubs; 8/14 keep their IST stacks).  A fault in the shell prints a
  white-on-red band to the framebuffer via gop::dump_lines (raw fb
  writes bypassing the vt, fully clamped) plus a parseable serial line:
  '!!! <kind> vec=N err=… rip=… cr2=… rsp=… rflags=… task=N "name"',
  then halts — instead of converging to a cryptic double fault.
  Background-task faults abort the task as before.
- Boot log now reports the authoritative post-SetMode geometry:
  'gop: fb base=… size=… pitch=… WxH bpp=… bgr=…', so the next real
  machine's report identifies whether pitch*height exceeds the mapping.
- Framebuffer writes (clear, push_rect, shift_up_n bulk push, cursor
  overlay) are clamped to the firmware's framebuffer_size: a pitch-
  padded mode degrades to a truncated view instead of faulting past
  the mapping.
- The GOP framebuffer region is excluded from the page allocator (and
  subtracted from the heap's conventional-region pick) even when the
  firmware lists it as ConventionalMemory — kernel allocations can
  never overwrite the display again.  The GOP protocol is located and
  peeked before the memory map is captured so the exclusion is known
  at heap-init time.
- Shell gains a hidden 'fault' command (deliberate unmapped write) and
  'make test-fault' verifies the dump: vec=14, cr2=0x400000000000,
  task=0, halt — no triple fault.  All other suites re-pass.
- CONTEXT.md: fault-dump format documented for real-hardware reports.

1 files changed, 13 insertions, 0 deletions

diff --git a/shell/src/lib.rs b/shell/src/lib.rs
index e1d54c8..3090776 100644
--- a/shell/src/lib.rs
+++ b/shell/src/lib.rs
@@ -721,6 +721,7 @@ write `{} <path> TIL <marker>`",
         "sleep" => cmd_sleep(&parsed),
         "kill" => cmd_kill(&parsed),
         "demo" => cmd_demo(&parsed),
+        "fault" => cmd_fault(),
         _ => term_err(&alloc::format!("unknown command: {}", cmd)),
     }
 }
@@ -806,6 +807,18 @@ fn cmd_hello(p: &Parsed) {
     pipe.end();
 }
 
+/// Deliberately fault on an unmapped address — test hook that verifies
+/// the fault-dump path (screen + serial) halts cleanly instead of
+/// triple-faulting.  The system stops; the log must show the dump.
+/// Canonical-but-unmapped address (below 2^47, above any RAM/MMIO): the
+/// page walk terminates at a not-present entry → #PF with CR2 = address.
+fn cmd_fault() {
+    term_println("fault: writing to 0x0000_4000_0000_0000...");
+    unsafe {
+        core::ptr::write_volatile(0x0000_4000_0000_0000usize as *mut u32, 0x1234u32);
+    }
+}
+
 fn cmd_clear() {
     rsnix::gop::clear_screen();
 }