feat(sched): Weave tiered scheduler with real kernel-thread context switching

Replace the state-relabel-only round-robin with the SUB-OS "Weave"
scheduler backed by a genuine callee-saved context switch. Threads now
actually run on their own kernel stacks instead of merely having their
state field rewritten.

What was implemented:
- sub_ctx_switch(): per-arch assembly (arch/x86_64/cpu/switch.asm,
  arch/aarch64/cpu/switch.S, arch/armv8i/cpu/switch.S) that saves/restores
  the callee-saved register set (+ flags on x86_64) on each thread's own
  stack, plus a first-run trampoline (sub_thread_trampoline) that launches
  a freshly forged thread frame with entry/arg in callee-saved registers.
- task_forge_frame(): builds the initial saved-context frame per arch so
  the very first switch into a new thread lands on the trampoline; task_t
  gains a pointer-sized ctx_sp so the same struct works on 64- and 32-bit.
- Weave policy (kernel/sched.c): WEAVE_NLANES priority lanes, always
  dispatch the lowest non-empty lane round-robin; a task that yields
  voluntarily is woven UP a lane (interactive), one preempted after
  burning its quantum is woven DOWN (CPU-bound). Cooperative switching
  (sched_yield / task_exit) is always live; timer-driven preemption is
  gated behind sched_set_preempt() and left disarmed for now.
- task_exit() now switches to the next runnable thread via
  sched_exit_current() instead of spinning/halting.
- Boot-time weave_selftest() (x86_64) and sched_dump() diagnostics.

How it was verified:
- Builds clean for all three targets: x86_64 (CROSS_COMPILE=x86_64-linux-gnu-,
  RUSTC="rustc --target x86_64-unknown-none"), aarch64, armv8i. No new
  warnings; the new x86_64 asm carries a .note.GNU-stack section.
- Booted x86_64 under QEMU (TCG): the self-test runs three cooperative
  kernel threads to completion on separate stacks with the expected
  1->2->3 round-robin interleave, reports "20 real context switches,
  3/3 workers exited", returns cleanly to the boot thread, and boot
  proceeds normally to ring-3 init and the shell. No fault/panic.

Left unverified:
- The aarch64/armv8i sub_ctx_switch frames build and link but are not yet
  boot-tested on their QEMU targets (tracked in docs/AUTODEV_ROADMAP.md).
- Timer preemption path is implemented but disarmed; exited kernel threads
  currently leak their stack (reaper is next in the backlog).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Jk6K69yGS7zYgvoWd6nJxQ

arch/x86_64/cpu/switch.asm

@@ -0,0 +1,55 @@
+[BITS 64]
+default rel
+
+; SUB-OS kernel context switch (x86_64)
+; -------------------------------------
+; sub_ctx_switch(void** save_sp /* rdi */, void* load_sp /* rsi */)
+;
+; Saves the SysV callee-saved registers plus RFLAGS of the outgoing thread onto
+; its own stack, stashes the resulting stack pointer through *save_sp, then
+; loads the incoming thread's stack pointer and unwinds the mirror image. From
+; C this looks like an ordinary call that "returns" only when this thread is
+; later switched back in. Caller-saved registers are the C caller's problem, as
+; usual, so nothing else needs preserving here.
+
+global sub_ctx_switch
+global sub_thread_trampoline
+
+extern task_exit
+
+section .text
+
+sub_ctx_switch:
+    push rbp
+    push rbx
+    push r12
+    push r13
+    push r14
+    push r15
+    pushfq
+
+    mov [rdi], rsp          ; *save_sp = outgoing stack pointer
+    mov rsp, rsi            ; adopt the incoming stack
+
+    popfq
+    pop r15
+    pop r14
+    pop r13
+    pop r12
+    pop rbx
+    pop rbp
+    ret
+
+; First-run trampoline. task_create() forges an initial frame so that the very
+; first switch into a fresh thread lands here with r12 = entry, r13 = argument.
+; We call the entry function, and if it ever returns we retire the thread.
+sub_thread_trampoline:
+    mov rdi, r13            ; arg
+    call r12               ; entry(arg)
+    xor rdi, rdi           ; void entry -> exit code 0
+    call task_exit
+.hang:
+    hlt
+    jmp .hang
+
+section .note.GNU-stack noalloc noexec nowrite progbits