fix: kernel hardening pass 2 — page tracking, queue overflow, region tracking

Page lifecycle:
- ProcessMemory now tracks (PhysicalAddress, count) pairs for each
  allocation (up to 16). destroy_process iterates and frees all
  pages back to the pool. No more permanent page leaks on exit/fault.
- RequestPages re-adds MemoryRegion entries so ReleasePages works.
  Release test un-ignored, passes.
- RequestPages: VA allocation moved after pool allocation succeeds,
  preventing VA leak on OOM.

IPC hardening:
- WaitQueue overflow (>16 waiters): returns WouldBlock error instead
  of silently dropping the thread. Thread is not blocked if enqueue
  fails.
- debug_assert on pending_messages[sender].take() — invariant that
  a sender in wait queue must have a pending message.

Scheduler:
- remove() now clears current thread if the removed thread was
  current on its core.
- add() asserts push succeeded; bitmap bit only set if thread was
  actually added to RunList.

Cleanup:
- Priority::DEFAULT replaces Priority::new(16).unwrap() in
  spawn_thread and spawn_thread_in.

36 kernel tests pass, 0 ignored.

crates/kernel/src/lib.rs

@@ -234,12 +234,8 @@ impl<P: Platform> Kernel<P> {
 
         // Free allocated pages back to pool
         if let Some(pm) = &self.process_memory[pid.raw() as usize] {
-            let page_count = pm.page_count();
-            if page_count > 0 {
-                // Pages were allocated from the pool but we don't track individual
-                // addresses. The page pool uses contiguous allocation, so we can't
-                // free without knowing the base address. Mark as returned for accounting.
-                // Full page tracking is a future improvement.
+            for &(pa, count) in pm.allocations() {
+                self.page_pool.free(pa, count);
             }
         }