Add kernel syscall-prune build cycle

The existing PGO cycle bundles config-only, syscall-prune, and
layout-ordering candidates into a single rebuild loop.  When all
we want is the syscall-prune verdict (e.g. tightening the prune
table after a userspace change), paying for the layout-ordering
detour is wasteful, and the QEMU trace + analyze step gets re-run
on every invocation.

build.sh grows kernel_syscall_prune_cycle alongside the existing
kernel_pgo_cycle: same primitives (build_candidate_kernel,
boot_not_regressed, restore_kernel_artifacts), but only baseline /
config-only / syscall-prune candidates, defaulting QEMU_LOG to
exec,cpu,in_asm so the R7 dumps needed for syscall extraction are
present.  The stage selects the smallest linux.axf that does not
regress shell_ready_ms, mirroring the existing cycle's selection
rule.

prepare_kernel_profile_analysis extracts the trace-collect+analyze
pair into a shared helper keyed on (IMAGE_FP, sha256(workload),
trace selector).  Both cycles share the namespace but resolve to
distinct cache directories via the trace tag, so PGO's exec,in_asm
trace and the new cycle's exec,cpu,in_asm trace do not collide.
IMAGE_FP already covers scripts/, configs/, patches/, and build.sh,
so any change that affects the baseline binary or the analysis
tooling invalidates the cache.

materialize_cache_tree uses cp -f rather than hardlinks:
link_cached_tree exposes cache files via symlinks in working dirs,
and a hardlink would let any future writer that follows that
symlink mutate the cache through a shared inode.  cp -f makes the
cache the canonical copy.

scripts/qemu-trace-to-orderfile.py rewrites the syscall pairing
state machine to match QEMU's actual -d cpu ordering: register
dumps precede the TB whose entry state they capture.  The previous
code kept a backward-binding fallback that, when a TB without a
preceding regdump showed up (orphan TB), bound the next R07 to the
orphan instead of holding it for the upcoming TB.  In a real trace
this silently misattributes or drops syscalls and feeds a wrong
prune table.  pending_tb is dropped entirely; an R07 always binds
forward to the next TB or stays pending until one arrives.

scripts/test_qemu_trace_to_orderfile.py covers the happy path, the
orphan-TB regression (which fails under the old backward-binding),
and the MAX_ARM_SYSCALL boundary at 511/512.

Three Python script invocations gain an explicit python3 prefix.
generate-syscall-prune-table.py is committed as 100644, so calling
it via the bare path raised Permission denied; the other two are
defensive consistency.

Author: jserv

.github/workflows/main.yml

@@ -183,7 +183,7 @@ jobs:
             qemu-system-arm
 
       - name: Download build image
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: bootable-image
           path: bootwrapper

.github/workflows/rollup-comment.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Download subsystem rollup artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: subsystem-rollup
           path: rollup
@@ -39,7 +39,7 @@ jobs:
 
       - name: Resolve PR number
         id: pr
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const run = context.payload.workflow_run;
@@ -64,7 +64,7 @@ jobs:
 
       - name: Upsert comment
         if: steps.pr.outputs.number != ''
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           # Pass the PR number through the environment instead of
           # interpolating it directly into the script body. Template
@@ -75,13 +75,24 @@ jobs:
         with:
           script: |
             const fs = require('fs');
-            // upload-artifact@v4+ preserves workspace-relative paths,
-            // so the markdown lives at its original profiles/ path
-            // inside the downloaded folder.
-            const body = fs.readFileSync(
+            const candidates = [
+              // download-artifact extracts the common parent of the
+              // uploaded files, so the current artifact lands flat at
+              // the destination root.
+              'rollup/subsystem-rollup.md',
+              // Keep accepting the older nested layout in case the
+              // upload path changes again.
               'rollup/profiles/kernel-pgo/none/subsystem-rollup.md',
-              'utf8',
+            ];
+            const bodyPath = candidates.find(candidate =>
+              fs.existsSync(candidate)
             );
+            if (!bodyPath) {
+              throw new Error(
+                `subsystem rollup markdown not found; checked: ${candidates.join(', ')}`
+              );
+            }
+            const body = fs.readFileSync(bodyPath, 'utf8');
             const marker = '<!-- subsystem-rollup-comment -->';
             const { owner, repo } = context.repo;
             const issue_number = Number(process.env.PR_NUMBER);