feat: vblank IRQ and double-buffered page flip for Intel GPU

Add tear-free scanout to the Intel GPU driver: a second kernel-allocated
scanout buffer, DSPASURF flips latched at vblank, and a vblank interrupt
delivered over MSI (Gen 11+ master/display/pipe IRQ chain) with a
monotonic vblank counter and WaitVblank().

Expose it as SYS_FBFLIP (150): index selects the front buffer, -1
queries support, flags bit0 waits for the flip to latch. fb_map() now
maps buffer 1 right after buffer 0 when flipping is available, and
gui::Framebuffer draws to the off-screen buffer and flips with vsync,
falling back to the direct copy when unsupported.

Scanout is restored to buffer 0 when the flip-owning process exits and
on panic, so the terminal and panic box never land on the invisible
buffer.

Co-Authored-By: Claude Fable 5 <[email protected]>

kernel/src/Sched/Scheduler.cpp

@@ -25,6 +25,7 @@
 #include <Api/LibSyscall.hpp>
 #include <Drivers/Audio/Mixer.hpp>
 #include <Drivers/USB/Bluetooth/A2dp.hpp>
+#include <Drivers/Graphics/IntelGPU.hpp>
 #include <Ipc/Ipc.hpp>
 
 // Assembly: context switch with CR3 and FPU state parameters
@@ -1110,6 +1111,11 @@ namespace Sched {
         // process was not the owner).
         Drivers::USB::Bluetooth::A2dp::ReleaseOutput(exitingPid);
 
+        // Restore scanout to buffer 0 if the exiting process owned page
+        // flips, so the next fullscreen client and the kernel terminal are
+        // never stranded on the invisible buffer (no-op for non-owners).
+        Drivers::Graphics::IntelGPU::OnProcessExit(exitingPid);
+
         // Release process-scoped IPC handles/mappings before tearing down the address space.
         Ipc::CleanupProcessSlot(slot, exitingPid, proc.pml4Phys);
         montauk::abi::CleanupHeapForSlot(slot, proc.pml4Phys);