fix: kernel hardening pass 2 — page tracking, queue overflow, region tracking

Page lifecycle:
- ProcessMemory now tracks (PhysicalAddress, count) pairs for each
  allocation (up to 16). destroy_process iterates and frees all
  pages back to the pool. No more permanent page leaks on exit/fault.
- RequestPages re-adds MemoryRegion entries so ReleasePages works.
  Release test un-ignored, passes.
- RequestPages: VA allocation moved after pool allocation succeeds,
  preventing VA leak on OOM.

IPC hardening:
- WaitQueue overflow (>16 waiters): returns WouldBlock error instead
  of silently dropping the thread. Thread is not blocked if enqueue
  fails.
- debug_assert on pending_messages[sender].take() — invariant that
  a sender in wait queue must have a pending message.

Scheduler:
- remove() now clears current thread if the removed thread was
  current on its core.
- add() asserts push succeeded; bitmap bit only set if thread was
  actually added to RunList.

Cleanup:
- Priority::DEFAULT replaces Priority::new(16).unwrap() in
  spawn_thread and spawn_thread_in.

36 kernel tests pass, 0 ignored.

crates/kernel/src/syscall/lifecycle.rs

@@ -13,9 +13,8 @@ impl<P: Platform> Kernel<P> {
         use domain::scheduler::Scheduler;
         use domain::thread::SavedContext;
 
-        let priority = types::bounded::Priority::new(16)
-            .unwrap_or_else(|| unreachable!());
-        let time_slice = types::time::TimeSlice::new(100);
+        let priority = types::bounded::Priority::DEFAULT;
+        let time_slice = types::time::TimeSlice::DEFAULT;
         let context = SavedContext::with_entry_and_stack(entry, stack);
 
         let tid = match self.threads.spawn_with_context(pid, priority, time_slice, None, context) {
@@ -97,9 +96,8 @@ impl<P: Platform> Kernel<P> {
             Err(e) => return SyscallOutcome::Complete(SyscallResult::Error(e)),
         };
 
-        let priority = types::bounded::Priority::new(16)
-            .unwrap_or_else(|| unreachable!());
-        let time_slice = types::time::TimeSlice::new(100);
+        let priority = types::bounded::Priority::DEFAULT;
+        let time_slice = types::time::TimeSlice::DEFAULT;
         let context = SavedContext::with_entry_and_stack(entry, stack);
 
         let tid = match self.threads.spawn_with_context(target_pid, priority, time_slice, None, context) {