feat(sched): Preemptive Weave scheduling driven by the timer tick

Kernel threads were only ever switched cooperatively (sched_yield, task_exit);
a thread that never yielded held the CPU forever. The Weave scheduler now
preempts from the PIT tick, so CPU-bound threads are time-sliced.

Deferred switch, not mid-handler:
- sched_tick() no longer switches. It charges the running quantum and, when it
  is spent, only raises weave_need_resched. The switch happens at IRQ return in
  the new sched_preempt_on_return(), called from the x86_64 dispatcher after
  the PIC EOI. That keeps the tick path re-entrancy-safe (the EOI is already
  out, so the PIC keeps delivering) and lets the preempted thread unwind
  through the normal iretq on its own kernel stack.

Interrupt-atomic scheduler state:
- The plain weave_lock is not IRQ-safe, so a tick landing mid-mutation would
  deadlock. weave_lock sections now mask interrupts (arch_irq_save/restore,
  added to arch.h for all three arches) so the timer can never fire inside
  them, and weave_rotate holds them masked across the pick and the register
  swap so the switch is one indivisible step.

Preemption-disable count:
- sched_preempt_disable/enable gate the tick and the return-path switch so a
  preemptive switch cannot land while a plain (non-IRQ-safe) spinlock is held.
  printk wraps its critical section with it, closing the most common hazard;
  other locks are a documented follow-up.

Fresh threads opt into interrupts at entry so they are preemptible from birth
without changing the cooperative early-boot self-test, which still runs with
interrupts masked and is unchanged (20 switches, 3/3 workers).

Verified on x86_64 under QEMU: a new boot-time self-test arms preemption and
two threads that NEVER yield are forced to share the CPU -- 20 involuntary
switches, both advance and are woven down to the CPU-bound lanes -- then boot
proceeds cleanly to ring-3 /sbin/init and the shell with zero faults. aarch64
and armv8i still build; preemption is wired into the x86_64 IRQ path only, so
those stay cooperative for now (their switch asm already exists).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

include/arch/arch.h

@@ -24,6 +24,19 @@ static inline void arch_disable_interrupts(void) {
     __asm__ volatile("cli");
 }
 
+/* Save the current interrupt-enable state and disable interrupts; restore puts
+ * it back exactly. Used to make a critical section atomic against IRQ handlers
+ * (e.g. the preemptive scheduler) without unconditionally re-enabling. */
+static inline unsigned long arch_irq_save(void) {
+    unsigned long flags;
+    __asm__ volatile("pushfq; pop %0; cli" : "=r"(flags) :: "memory");
+    return flags;
+}
+
+static inline void arch_irq_restore(unsigned long flags) {
+    __asm__ volatile("push %0; popfq" :: "r"(flags) : "memory", "cc");
+}
+
 static inline void arch_halt(void) {
     __asm__ volatile("hlt");
 }
@@ -59,6 +72,16 @@ static inline void arch_disable_interrupts(void) {
     __asm__ volatile("msr daifset, #2" ::: "memory");
 }
 
+static inline unsigned long arch_irq_save(void) {
+    unsigned long flags;
+    __asm__ volatile("mrs %0, daif; msr daifset, #2" : "=r"(flags) :: "memory");
+    return flags;
+}
+
+static inline void arch_irq_restore(unsigned long flags) {
+    __asm__ volatile("msr daif, %0" :: "r"(flags) : "memory");
+}
+
 static inline void arch_halt(void) {
     __asm__ volatile("wfi");
 }
@@ -101,6 +124,16 @@ static inline void arch_disable_interrupts(void) {
     __asm__ volatile("cpsid i" ::: "memory");
 }
 
+static inline unsigned long arch_irq_save(void) {
+    unsigned long flags;
+    __asm__ volatile("mrs %0, cpsr; cpsid i" : "=r"(flags) :: "memory");
+    return flags;
+}
+
+static inline void arch_irq_restore(unsigned long flags) {
+    __asm__ volatile("msr cpsr_c, %0" :: "r"(flags) : "memory", "cc");
+}
+
 static inline void arch_halt(void) {
     __asm__ volatile("wfi");
 }

include/kernel/sched.h

@@ -43,8 +43,18 @@ void sched_leave(void);
  * early boot can run to completion deterministically. */
 void sched_set_preempt(bool armed);
 
-/* Diagnostics + the boot-time context-switch self-test. */
+/* Preemption-disable count: code holding a plain (non-IRQ-safe) spinlock raises
+ * this so a preemptive switch cannot run while that lock is held. Nesting OK. */
+void sched_preempt_disable(void);
+void sched_preempt_enable(void);
+
+/* Called from the arch IRQ dispatcher after the interrupt is acknowledged: if
+ * the timer tick asked for a reschedule and it is safe, switch away now. */
+void sched_preempt_on_return(void);
+
+/* Diagnostics + the boot-time self-tests (cooperative, then preemptive). */
 void sched_dump(void);
 void weave_selftest(void);
+void weave_preempt_selftest(void);
 
 #endif // _KERNEL_SCHED_H