Make hosted File lifecycle dispatch reentrant-safe

[stakach]

Dependency of #17 before a live win32k ZwClose cutover.

Contract

• Represent each CLEANUP/CLOSE dispatch as an owned, generation-checked File/IRP invocation. Record ownership before the driver effect. PR Own hosted File lifecycle dispatch before driver entry #58.
• Release every mutable IoManager borrow before hosted component IPC; resume/commit only against the exact retained invocation after the reply, including uncertain outcomes and cancellation.
• Permit a driver callback to initiate another final File close without aliasing the global manager or deadlocking behind a process-wide progress guard.
• Preserve final-handle NtClose wait semantics, synchronous Busy ordering, and real CLEANUP then CLOSE completion. No synthetic success or retry of uncertain effects.
• Add crate tests for nested dispatch, stale generation, ambiguous reply, cancellation, and independent driver/file owners; then native build and bounded boot. Report desktop proof separately.

Review finding: driver_launch::pump_io_manager holds a global &mut ExecutiveIoManager through IoManager::pump_with_report, whose deferred-close path dispatches hosted driver IPC. A reverse callback can reenter the same manager. The existing hosted-file retirement drain intentionally defers reentry, but that guard is not sufficient for a new final close after its PM handle effect.

PR #58 proved owned dispatch and ACK state in the crate (730 tests), native build, and unchanged bounded boot gate. Native integration, owned cancellation and ACK reconciliation remain open.

[stakach]

Verified prerequisite increment on codex/owned-file-lifecycle (e99fbf6): nt-io-manager now exposes manager-bound, generation-exact owned CLEANUP/CLOSE prepare/begin/finish and retained completion/ACK transactions. Same-driver and distinct-driver nested owners, stale identities, no-entry retry, uncertain no-replay, CLEANUP->CLOSE ordering, early completion, pending ACK, and genuine cancelled completion have focused tests. Full crate suite: 730 passed. Native executive build passed. Bounded boot reached the unchanged strict 27 unresolved win32k import gate; QEMU stopped there. This does not switch the live pump yet. Remaining: owned cancellation/ACK reconciliation and native pump/close cutover that releases the manager borrow across hosted driver IPC, then live boot/desktop proof.

[stakach]

Native cutover audit: two inline backend-entry edges remain, release_hosted_file_with_provenance -> release_external_file -> finish_deferred_file_close and pump_io_manager -> pump_with_report -> retry_deferred_file_closes. pump_io_manager also has callers holding an outer &mut manager reference (notably completed_irp_copy_requires_retry), so the eventual native orchestrator must use short prepare/finish borrows only, with no manager/owner-row borrow across hosted IPC. DriverPeer lifecycle should be selected by generation-bearing File/IRP, retain physical route authority before dispatch, and preserve indeterminate effects. Existing file_cleanup_redrive_all waits for actual File disappearance; keep that final NtClose condition. Crate-level queue-only release is in progress as the next prerequisite.

[stakach]

Replan after native trial: 733 nt-io-manager tests and native build passed with the owned DriverPeer cutover, and bounded boot reached the unchanged 27-import win32k gate. However, that boot logged no hosted-file release before the gate, so it did not exercise the new native owner table or prove callback reentrancy. I removed the unexercised native adapter from the proposed increment. The next PR will include only tested queue-only release, opt-in manager selection, and caller-borrow narrowing. Issue #56 remains open. Before live cutover, add an executable native harness or boot path that dispatches real hosted CLEANUP/CLOSE, including nested callback and pending/uncertain ACK, then merge the adapter only with that proof.

[stakach]

PR #59 merged after CI: queue-only external File release, pending-CREATE abandonment without inline backend entry, explicit opt-in owned DriverPeer lifecycle selection, and no caller-held manager borrow at the executive pump entrypoint. Full nt-io-manager suite: 734 passed; native build passed; bounded boot hit the unchanged 27-import win32k gate. The executive does not yet enable the mode. Remaining checklist items are intentionally open: executable native hosted lifecycle proof, owner-table cutover, cancellation/ACK reconciliation, nested callback verification and desktop evidence.