Prospero: validate physical patch writes

[ygordreyer]

Related to #11.

Problem

On newer PS5 firmware, XML patching could continue after a write failed. The physical writer also reused a cached p_proc and did not revalidate the target mapping immediately before each chunk, which could leave a stale kernel pointer in the launch path.

Changes

• Walk allproc without the SDK process cache on Prospero above 8.20.
• Validate the PID, vmspace, pmap, PML4, CR3, page-table entries, and physical ranges.
• Recheck the process and mapping before each physical chunk, with a bounded per-payload writer lock.
• Validate XML write spans, propagate userland_copyin2 errors, stop at the first failed line, and skip the later PRX pass.

Test

• Clean Orbis and Prospero builds with -Wall -Werror.
• On one PS5 running 11.60 with CUSA00900 1.09: 130 read-only target checks, 130 original-byte writebacks with matching readbacks, then 130 requested writes with matching readbacks. The game launched and closed normally without a panic.

The console run used the instrumented test branch with kstuff-lite 1.09 and a per-title no-pause rule. This PR contains only the production writer and error-handling changes. It does not roll back XML lines completed before a later failure.