fix: discover the vgpu region in the producer process user space

The region is a shared mapping in a producer process's user address space, not a kernel VA: open a read-only process context, enumerate processes, and locate it by structural invariants under each process cr3. Frames, cursor, geometry and status are read under the producer's cr3.

src/perception/control.c

@@ -5,6 +5,10 @@
  * the intent and computes the GVA + offset/length of the significant field range
  * for that atomic write under the ctrl_gen seqlock. There is no gva_write here
  * and there must not be — the source is a RO fd that would fault on a store anyway.
+ *
+ * The reported out_ctrl_gva is a GVA in the PRODUCER's user address space
+ * (region base + VGPU_CONTROL_OFFSET, cached as r->ctrl_gva): the external write
+ * MUST be performed under r->proc_cr3, NOT the System kcr3.
  */
 
 #include "perception-internal.h"