feat: vblank IRQ and double-buffered page flip for Intel GPU

Add tear-free scanout to the Intel GPU driver: a second kernel-allocated
scanout buffer, DSPASURF flips latched at vblank, and a vblank interrupt
delivered over MSI (Gen 11+ master/display/pipe IRQ chain) with a
monotonic vblank counter and WaitVblank().

Expose it as SYS_FBFLIP (150): index selects the front buffer, -1
queries support, flags bit0 waits for the flip to latch. fb_map() now
maps buffer 1 right after buffer 0 when flipping is available, and
gui::Framebuffer draws to the off-screen buffer and flips with vsync,
falling back to the direct copy when unsupported.

Scanout is restored to buffer 0 when the flip-owning process exits and
on panic, so the terminal and panic box never land on the invisible
buffer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kernel/src/Common/Panic.cpp

@@ -5,6 +5,7 @@
 
 #include "Panic.hpp"
 #include "../CppLib/BoxUI.hpp"
+#include "../Drivers/Graphics/IntelGPU.hpp"
 
 static constexpr int BoxWidth = 72;
 
@@ -65,6 +66,11 @@ static void PrintRegisters(System::PanicFrame* frame) {
 }
 
 void Panic(const char *meditationString, System::PanicFrame* frame) {
+    // Bring scanout back to buffer 0 first: if a page-flipped client was
+    // showing the other buffer, the panic box would land on an invisible
+    // surface. Safe no-op when the GPU driver is inactive.
+    Drivers::Graphics::IntelGPU::PanicRestoreScanout();
+
     // Header
     kerr << BOXUI_ANSI_RED_BG << BOXUI_ANSI_WHITE_FG << BOXUI_ANSI_BOLD << "\n";
     PrintHorizontalEdge(BOXUI_TL, BOXUI_TR);