kernel: fix pci-scan triple fault and flaky restart-drill checks

pciScanTest put three [64]DeviceDescriptor arrays on the stack; at 328
bytes each that is a 66,096-byte frame, larger than the 64 KiB bootstrap
stack the boot context runs on, so the prologue overflowed the stack and
triple-faulted on entry before the test could print anything — the CPU
reset with no exception line. Reuse one descriptor buffer (frame ~21 KiB).

With the fault gone, the restart-drill checks proved flaky. They polled
process.write_buffer (which holds only the latest write-syscall message)
for the transient restarting/re-scan lines, which the concurrent
class-driver output overwrote before the starved low-priority poller could
observe them. The kernel broker count can't witness the restart either:
register is idempotent and the table has no unregister, so the count is
invariant across kill/prune/respawn.

Follow the sibling restart drills (usbReportTest/driverRestartTest): assert
the ordered drill in the harness regex over the full serial log (a
backreference requires the respawn to re-scan the same count), and keep only
race-free broker checks in the kernel — empty before the scan, populated
once it settles, never growing past N — sampled via scheduler.sleep at a
fixed cadence instead of a busy-poll.

test/qemu_test.py

@@ -486,12 +486,23 @@ CASES = [
      "expect": r"acpi: reported PNP0303 \(device \d+, 3 resources\)[\s\S]*"
                r"acpi: reported PNP0F13 \(device \d+, 1 resources\)",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
-    # M19.1: the ring-3 PCI scan (pci-bus walks the ECAM through its mmio_map
-    # grant) finds exactly the functions the kernel's own walk recorded.
+    # M19.1/M19.3: the ring-3 PCI scan. pci-bus walks the ECAM through its mmio_map
+    # grant and registers every function it finds; the kernel's own walk retired, so
+    # the broker starts empty and the driver populates it. The manager then runs the
+    # restart drill: ~1 s after the scan it kills pci-bus, prunes its child tree, and
+    # respawns it to re-claim, re-scan, and re-register the same functions. The kernel
+    # test asserts the broker equivalence (empty before, populated after, no
+    # duplicates); this ordered regex asserts the drill itself over the whole serial
+    # log — the backreference requires the respawn to re-scan the same count, and the
+    # full-capture match is immune to the transient-line races an in-kernel poll hits.
     {"name": "pci-scan",
      "smp":    4,
      "timeout": 60,
-     "expect": r"DANOS-TEST-RESULT: PASS",
+     "expect": r"pci-bus: (\d+) functions found[\s\S]*"
+               r"device-manager: test mode: killing the reporter[\s\S]*"
+               r"device-manager: restarting pci-bus[\s\S]*"
+               r"pci-bus: \1 functions found[\s\S]*"
+               r"DANOS-TEST-RESULT: PASS",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
     # M18.3: the application surface — device-list enumerates the tree over IPC,
     # subscribes (endpoint as capability), and observes the removed/added events