fix(block): make virtio BIO backpressure event driven

[fslongjin]

Summary

Replace VirtIO BIO budget cooldown with event-driven descriptor backpressure, and close related ownership/publication gaps.

• Limit dequeue to the worker's remaining budget. A partially filled earlier batch must not cause a later batch's tail to be dropped.
• Treat unpublished QueueFull as retryable, retaining the current BIO in order. Reuse WaitQueue condition checking rather than adding an epoch or descriptor-count mirror.
• Wake resource waiters after descriptor reclamation and before callbacks. Shutdown wakes them after publishing non-Online and before joining the worker.
• Keep default fair scheduling, retain bounded work rounds and use cond_resched(), removing the fixed 20 ms sleep and FIFO override.
• Serialize submission, token-context publication and Submitted state against completion on other CPUs with the existing device lock.
• Keep callbacks outside the device lock and explicitly retain DMA context on a fatal duplicate-token invariant failure, since panic may unwind.

No journal, flush ordering, VirtQueue size, rate-limiting framework or public syscall ABI changes. The optional diagnostic counter queue_full_retries counts failed admission attempts, not failed BIOs. budget_hits now counts exhausted work rounds, not timed cooldowns.

Before/after evidence

Check	Before	After
Production BioQueue, uneven batches	Dequeued 33 with budget 32	Dequeues 32, leaves one queued in FIFO order
32 independent readers, 64 LBA0 reads each	QueueFull errors and approximately 60-second timeout	Five rounds pass on two vCPUs, five on one vCPU
Resource-pressure coverage	QueueFull becomes EIO	Retries observed; errors, short completions and remaining in-flight BIOs are zero

The guest regression is read-only and verifies stable LBA0 contents. Each reader opens its own file description to avoid VFS per-file serialization. It skips explicitly when the VirtIO block device is unavailable and is included in the dunitest whitelist.

Validation

• make kernel with diagnostic statistics enabled: pass.
• Static dunitest build: pass.
• Host production-queue tests: 2/2, covering budget ownership, FIFO, zero limit, quiescing, stopping and rejected submissions.
• QEMU two-vCPU read test: 5/5, approximately 68–95 ms per round, with 8 QueueFull admission retries.
• QEMU one-vCPU read test: 5/5, approximately 76–95 ms per round, with 68 retries. A concurrent normal CPU workload also finishes.
• Both configurations reach peak in-flight 32 and finish with submits equal to completes, zero I/O errors and zero in-flight requests.
• Existing guest ext4 inode suite: 44/44.
• Git full object checking, local up-to-date pull and sync: pass.
• A 32 MiB file write/fsync probe on the guest root filesystem: pass.
• Three-role adversarial review completed; one panic-unwind DMA lifetime finding was fixed and rechecked.

Host test command:

rustc --edition=2021 --test tools/block/test_bio_queue.rs -o /tmp/test-bio-queue
/tmp/test-bio-queue

Limits

The host harness substitutes synchronization primitives and validates actual queue logic, not kernel scheduling. The guest tests do not exhaustively inject hot-removal races, media errors or all wakeup interleavings. The single-core CPU workload is a progress smoke test, not a fairness or tail-latency guarantee. This PR does not claim to remove the remaining ext4 small-file synchronization cost.

[fslongjin]

@codex review