Fault-exit deferred drain is unbounded under IRQ mask

[ryanbreen]

Fault-exit deferred drain is unbounded under IRQ mask

The 8x16-slot DEFERRED_FAULT_EXIT_BUFFERS (drained by
drain_deferred_fault_sigsegv_exits() in kernel/src/arch_impl/aarch64/context_switch.rs, called at
the top of schedule_from_kernel() around line 4460) can replay up to 128 sequential
handle_thread_exit passes in a single schedule_from_kernel invocation during a fault storm — one
pass per occupied slot across all 8 CPUs. Each pass takes the process-manager (PM) lock, extracts file
descriptors, and defers page-table teardown, all while running under the caller's IRQ mask. This is
pre-existing behavior, not introduced by this round's changes (round fix/teardown-followups-r23, commit
83aaa18a bounded the deferred process-resource drain and terminated-thread reclaim on the same idle
path, but deliberately left this fault-exit drain unbounded).

Direction

Apply the same per-pass cap pattern used for the now-bounded sweeps (call-site limit: usize parameter,
usize::MAX for unbounded/fork-path use, small bound like 4 for the idle path), with care for:

• Slot wraparound in DEFERRED_FAULT_EXIT_BUFFERS (a partial drain must leave the buffer state
  consistent for the next pass, not lose or duplicate entries).
• Fault-storm backpressure — if the bound is hit while entries remain, the storm must not be allowed to
  grow the backlog unboundedly across ticks; needs a policy for what happens to overflow between passes.

Reference: identified during review of fix/teardown-followups-r23 (bounded idle-path teardown
reclamation round).