virtio-gpu: a modern virtio 1.0 display driver, bring-up to a flushed frame (v2 V3)

The first native scanout backend's driver half. The device manager matches the
virtio-gpu PCI function by its Display/Other class triple and spawns the driver,
which claims the device, confirms vendor 0x1AF4/device 0x1050 from config space,
enables memory-space + bus mastering, and walks the virtio vendor capabilities to
find the common-config and notify structures in its BAR.

From there it is the standard modern-virtio bring-up: reset, negotiate VERSION_1,
stand up the control virtqueue in coherent DMA, then drive the GPU end to end —
RESOURCE_CREATE_2D, ATTACH_BACKING (a coherent DMA buffer; V4 swaps in the shm-
shared surface), SET_SCANOUT, paint a known pattern, TRANSFER_TO_HOST_2D,
RESOURCE_FLUSH, and wait for the device's used-ring ack. Reading the backing back
proves it is CPU-visible RAM; the ack proves the device consumed the frame —
together the automated stand-in for "it's on screen", no screenshot.

- system/drivers/virtio-gpu/: the driver, plus virtio-gpu-protocol.zig (control
  commands) and virtio-pci.zig (the 1.0 PCI transport + split-virtqueue), both with
  host-tested struct sizes.
- device-manager matches the display/other class triple to "virtio-gpu"; the driver
  self-confirms the vendor/device id, since the class alone cannot distinguish it.
- ServiceId.scanout (11): the driver registers it so the compositor finds it in V4.

Gate: python3 test/qemu_test.py virtio-gpu (QEMU -device virtio-gpu-pci) — the
device-manager stack discovers the function, the driver brings up a 640x480 scanout
and flushes a test pattern: "virtio-gpu: scanout 640x480 online" + "flush acked,
pixel check ok". host tests, display-service, shm, and device-list still pass.

Note: the pre-existing pci-scan case triple-faults on main (verified at 88ad432,
before this change); it is unrelated and tracked separately.

docs/display-v2-plan.md

@@ -79,21 +79,26 @@ pattern, and passes its capability to `shm-server` as an `ipc_call` send_cap; th
 `ipc`/`ipc-call`/`ipc-cap`, `supervision`, `dma`, `usermem`, `display-service`, and host
 tests all still pass — the handle-table change broke no existing IPC.
 
-## V3 — The virtio-gpu driver: bring-up + a frame on screen
+## V3 — The virtio-gpu driver: bring-up + a frame on screen ✅
 
-- [ ] `system/drivers/virtio-gpu/`: claim the virtio-gpu PCI function (device-manager
-      match on its PCI/virtio id), map BARs, negotiate features, set up the control
-      virtqueue. `virtio-gpu-protocol.zig` for the control structs (host-tested sizes).
-- [ ] Create a 2D scanout resource backed by an `shm` region, `attach_backing`,
-      `set_scanout` to CRTC 0, and `resource_flush` a test pattern.
-- [ ] Register a `scanout` service (new `ServiceId`).
+- [x] `system/drivers/virtio-gpu/`: claim the virtio-gpu PCI function (device-manager
+      match on the display/other class triple, driver self-confirms vendor 0x1AF4/device
+      0x1050 from config space), enable memory-space + bus-master, walk the vendor
+      capabilities in config space to find common-config + notify, map the BAR, negotiate
+      VERSION_1, and stand up the control virtqueue in coherent DMA. `virtio-gpu-protocol.zig`
+      + `virtio-pci.zig` for the control/transport structs (host-tested sizes).
+- [x] Create a 2D scanout resource backed by a coherent DMA region (V4 swaps this for the
+      shm-shared surface), `attach_backing`, `set_scanout` to scanout 0, `transfer_to_host_2d`
+      + `resource_flush` of a test pattern, and wait on the used ring.
+- [x] Register a `scanout` service (`ServiceId.scanout` = 11).
 
-**Gate (automated):** a `virtio-gpu` case (QEMU `-device virtio-gpu`) where the driver
-writes a known test pattern into the shm scanout resource, `resource_flush`es it, and
-**waits for the device's used-ring ack**, then reads the resource back and checks the
-pattern — logging `virtio-gpu: scanout {w}x{h} online` and `virtio-gpu: flush acked, pixel
-check ok`. That proves virtqueue + resource + attach + set_scanout + flush end to end
-without a screenshot (the used-ring ack is the device confirming it consumed the frame).
+**Gate (met):** the `virtio-gpu` case (QEMU `-device virtio-gpu-pci`) boots the
+device-manager stack, which discovers the function and spawns the driver; the driver writes
+a known test pattern into the scanout backing, `transfer_to_host_2d` + `resource_flush`es
+it, and **waits for the device's used-ring ack**, then reads the backing back and checks the
+pattern — logging `virtio-gpu: scanout 640x480 online` and `virtio-gpu: flush acked, pixel
+check ok`. That proves virtqueue + resource + attach + set_scanout + transfer + flush end to
+end without a screenshot (the used-ring ack is the device confirming it consumed the frame).
 
 ## V4 — The native backend + hot-attach