fix: VirtIO GPU driver and snake rendering through display server

- Fix swapped command IDs: attach_backing was 0x0104 (FLUSH),
  resource_flush was 0x0106 (ATTACH_BACKING). Now correct.
- Increase process stack from 4 pages (16 KB) to 16 pages (64 KB)
  to prevent stack overflow in display process.
- Restructure display-qemu to avoid MockFramebuffer's 32 KB array
  inflating the VirtIO path's stack frame.
- Wire snake app to render through display server via IPC instead
  of UART escape codes. Uses existing renderer.rs pixel renderer.
- Init now delegates display endpoint to snake process.

crates/hw-virtio/src/gpu.rs

@@ -22,7 +22,7 @@ pub fn create_2d(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDmaAddrs,
 }
 
 pub fn attach_backing(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDmaAddrs, resource_id: u32, fb_pa: PhysicalAddress, fb_size: u32) -> bool {
-    write_cmd_header(dma.cmd_va, 0x0104);
+    write_cmd_header(dma.cmd_va, 0x0106);
     unsafe {
         let p = dma.cmd_va.raw() as *mut u8;
         core::ptr::write_volatile(p.add(24) as *mut u32, resource_id);
@@ -60,7 +60,7 @@ pub fn transfer_to_host(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDm
 }
 
 pub fn resource_flush(mmio: &impl MmioAccess, queue: &VirtioQueue, dma: &GpuDmaAddrs, resource_id: u32, x: u32, y: u32, w: u32, h: u32) -> bool {
-    write_cmd_header(dma.cmd_va, 0x0106);
+    write_cmd_header(dma.cmd_va, 0x0104);
     unsafe {
         let p = dma.cmd_va.raw() as *mut u8;
         core::ptr::write_volatile(p.add(24) as *mut u32, x);