Add guarded kernel stacks and harden RISC-V trap entry against stack overflow

[codingskynet]

Summary

• Add guarded virtual-address slots for kernel thread stacks.
• Detect kernel stack overflow before allocating a TrapFrame.
• Validate trap-frame boundaries for both S-mode and U-mode traps.
• Switch to an emergency panic stack when the selected kernel stack cannot fit a trap frame.
• Preserve the U-mode stack pointer safely during validation.
• Add independent destructive smoke tests for S-mode stack overflow and U-mode trap-frame overflow.

Trap Entry Changes

U-mode trap entry now reserves a small, known-mapped scratch area at the top of the kernel stack.

The entry sequence:

1. Saves t0 and the user stack pointer in the scratch area.
2. Clears sscratch before validating the prospective trap-frame address.
3. Validates kernel_sp - size_of::<TrapFrame>() against the guarded stack slot.
4. Allocates and initializes the trap frame only after validation succeeds.
5. Switches directly to the emergency panic stack when validation fails.

Clearing sscratch before the boundary check ensures that a nested synchronous fault follows the S-mode entry path instead of interpreting the user stack pointer as a kernel stack pointer.

Smoke Tests

S-mode Kernel Stack Overflow

Feature:

smoke-kernel-stack-overflow

This test moves the active kernel stack pointer below the mapped stack boundary and performs a store. It verifies that:

• A StorePage fault occurs in the guard page.
• Trap entry switches to the emergency panic stack.
• The kernel reports a kernel stack overflow.

U-mode Trap-frame Overflow

Feature:

smoke-user-trap-stack-overflow

This test places the U-mode trap scratch anchor at the lower mapped stack boundary and enters user mode. The first system call verifies that:

• The prospective TrapFrame is rejected before its first store.
• No intermediate guard-page fault or user-memory corruption occurs.
• The original EnvironmentCallFromUMode cause is preserved.
• Trap entry switches directly to the emergency panic stack.

The two destructive tests run in separate QEMU instances in CI.

Validation

• cargo clippy passes with warnings denied for both smoke-test feature configurations.
• The workspace builds successfully with all features enabled.
• The normal userland QEMU smoke test passes.
• The S-mode overflow smoke reports PageFault(StorePage(...)).
• The U-mode trap overflow smoke reports EnvironmentCallFromUMode.
• git diff --check passes.