memwrite: per-process (cr3) target and full-extent socket SRC

- CMD_MEMWRITE now carries a target page-table root (cr3) as its first field;
  cr3 == 0 keeps the kernel address-space default (backward-compatible). A control
  that has discovered a process's cr3 through its own read-only perception can
  write that process's private memory under the same exclusive write lease.
  Freshness of the cr3 is the control's responsibility — signaling does not
  validate it (that is perception, not coherence), mirroring the read side.

- A socket control can now carry an SRC larger than the inline frame budget: a
  length-prefixed SRC tail follows the CMD_MEMWRITE frame (flag SRC_PAYLOAD, the
  length being the frame's own len). A per-connection two-phase receiver
  accumulates the tail into a fixed conn-owned buffer up to the extent bound,
  matching the in-process payload path. A zero or over-bound length is a framing
  violation that closes the connection: leaving the promised tail unread would
  desync the stream and draining an arbitrary length would be a denial of service.

The capability, exclusive lease, source and extent gates are unchanged and
reused; only the event header gained the cr3 field and the socket transport
gained the tail receiver. The adapter resolves cr3 == 0 to the kernel root on
its worker thread and writes atomically.

CMakeLists.txt

@@ -87,6 +87,8 @@ add_test(NAME sec COMMAND vmsig_sectest)
 
 add_executable(vmsig_socktest src/test/test_sock.c)
 target_link_libraries(vmsig_socktest PRIVATE vmsig Threads::Threads)
+target_include_directories(vmsig_socktest PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}/src/adapter/memctx/include)
 target_compile_options(vmsig_socktest PRIVATE -Wall -Wextra)
 add_test(NAME sock COMMAND vmsig_socktest)