snapshot: normalize scc rr0 against the fifos cleared on load

[mach-kernel]

Changes

• Normalize rr0 against the FIFOs channel_from_toml just emptied: clear RX_CHAR_AVAILABLE, set TX_BUFFER_EMPTY.
• Re-arm tx_int_pending from WR1 TX_INT_EN and WR5 TX_ENABLE, matching the TX thread's wait predicate, so a restore cannot latch an interrupt on a disabled transmitter.
• Call update_ip so the SCC redrives the IOC line. power_on_devices clears map_stat SERIAL (ioc.rs:824) and Ioc::load_state restores it wholesale (ioc.rs:864), both before scc().load_state (machine.rs:1451/1454).
• RX_CHAR_AVAILABLE cannot self-heal: read_data returns 0 without touching the bit over an empty queue, so a guest polling RR0 spins forever. TX_BUFFER_EMPTY is hardening, since Machine::stop() drains the FIFO in the 3.7-8.4 ms between cpu.stop() and the SCC join.

Coverage / needs eyes

• 5 of 7 z85c30 tests fail with only the channel_from_toml hunk reverted:
  • restore_clears_rx_char_available
  • restore_forces_tx_buffer_empty
  • restore_rearms_tx_int_pending
  • restore_channel_b_tx_int_reaches_rr3_via_a
  • restore_redrives_irq_line
• Both halves of the gate have a test, and both assert tx_int_pending directly because get_ip gates on WR1 alone, so neither is observable through RR3:
  • restore_leaves_latch_disarmed_when_tx_int_disabled fails if the WR1 conjunct is deleted
  • restore_leaves_latch_disarmed_when_transmitter_disabled fails if the WR5 conjunct is deleted
• Channel B has its own test: machine.rs:213 installs the CI console there, and read_b_control returns 0 for RR3, so B reaches the guest only through A via the shared ip_other.
• cargo test --release --features lightning,rex-jit,chd: 363 passed, 11 ignored.
• Not measured here: how often a real guest lands on the RX_CHAR_AVAILABLE case.