keep the AP trampoline inert between wakes, and retry failed cores

Arm the low frame (copy blob, make executable) only while a core climbs, then zero it and restore RW+NX; the frame stays reserved so cores can be re-woken. startSecondary is one re-runnable attempt; boot retries a non-responding core 3x. Validated the retry path by forcing a first-attempt failure.

docs/smp.md

@@ -198,6 +198,16 @@ next lands.
 - **`single_threaded` off** — the kernel was built `single_threaded = true`, which
   compiles `std.atomic` down to plain non-atomic ops. Harmless on one core, but it
   quietly breaks the big kernel lock across cores; it's now `false`.
+- **Re-armable wake + retry** — the trampoline frame is reserved for the system's
+  life, but kept **inert between wakes**: zeroed and non-executable, armed (blob
+  copied in, page made executable) only for the moment a core is actually climbing,
+  then disarmed again. So there's never a dormant executable page, and a core can be
+  (re)woken at any time — `arch.startSecondary` is one self-contained attempt (arm →
+  INIT–SIPI–SIPI → disarm), and its `INIT` resets a wedged core, so retrying just
+  works. Boot retries a non-responding core up to three times; the same primitive is
+  the groundwork a future **power manager** would drive to bring cores up (and,
+  eventually, its counterpart to take them offline — which additionally needs the
+  core's tasks migrated off first).
 
 **Next (refinement, not first-light):**