snapshot: serialize the hpc3 pdma latched flags

[mach-kernel]

Changes

• Serialize the latched flags in save_pdma_channel / load_pdma_channel. Additive, so older snapshots lack the keys and keep their current values.
  • cleared by Hpc3::power_on: eox, eop, xie, rown
  • left stale by Hpc3::power_on: width_16, even_high, endian
• So an in-place restore inherited the previous run's values for the second group, and a fresh process got constructor defaults.
• Serialized, not re-derived:
  • fetch_descriptor does derive eox/eop/xie/rown from bc, which is serialized, but a raw BC register write updates only eox and xie and leaves eop and rown stale.
  • endian is not derivable at all. PDMA_CTRL_LITTLE (hpc3.rs:132) and PDMA_CTRL_ACT (hpc3.rs:139) are both 1 << 1, and PbusDmaOps::write (hpc3.rs:723) consumes the written value into chan.endian without assigning chan.ctrl, so deriving it from ctrl on channels 0-7 is exactly is_active().
• width_16 splits the same way: ScsiDmaOps writes dmacfg alone at hpc3.rs:822 and writes dmacfg with width_16 at 827, so dmacfg & SCSI_DMACFG_DMA16 does not reproduce the live value.

Coverage / needs eyes

• hpc3::tests::latched_flags_reach_a_fresh_device fails with the production hunks reverted: chan 0 lost eox. save_load_round_trip passes there, since a round-trip cannot see a field dropped from both halves.
• Tests sample one channel per ops group:
  • 0 PbusDmaOps
  • 8 ScsiDmaOps
  • 10 EnetRxDmaOps
  • 11 EnetTxDmaOps
• cargo test --release --features lightning,rex-jit,chd: 357 passed. cargo test hpc3 previously ran zero tests.
• Out of scope: PdmaChannel::misc is also unserialized and also untouched by power_on. It gates fetch_descriptor at hpc3.rs:919.