refactor(VMPromising): Track translation snapshot ranges

[febyeji]

Fixes an ETS2 invalid-PTE case and adds snapshot optimisation. The motivating test is R+rel+lws-mmufault-po, which expects Forbidden in the VMSA-ETS2 kind, while the old ArchSem behavior could produce no-behaviour.

Initial page table:
  z |-> pa_z with [Valid = 0b0]   // z is invalid from the start

P1:
  STR y = 2                       // advances the write view
  STR z = 0                       // should read the invalid PTE and take a translation fault

P1 EL1 handler:
  LDR x                           // runs after the fault

Forbidden final condition:
  *pa_y = 2 /\ 1:X2 = 0

Before this patch, the invalid z fault candidate was only seen from the initial snapshot (trans_time = 0). After STR y = 2 advanced the write view, ETS2 rejected that stale 0 < vwr candidate, leaving no invalid translation candidate for STR z.

This patch:

• collects ETS2 invalid fault candidates from snapshots after the prior read/write view;
• preserves the existing valid-PTE translation behavior. AF=0 final descriptor handling is left for a separate fix.

Ref: Arm ARM DDI0487M.c B2.3 treats Translation Fault Effects as TLBUncacheable, and FEAT_ETS2 orders the implicit TTD read before such a fault, so the invalid PTE read must be selected from a sufficiently late snapshot.

[tperami]

Whwwhsewb

[tperami]

Good to go after removing distinct check and fixing the other comment