[MG_Remote] (P6/cp): a real trace retraces across two processes, pixel-for-pixel

OpenRA.DirectGLES.SPAWN is green: ssim=1.000000, mismatchPixels=0, zero
Fatal{ lines, against a server in a process the client started by name. The
inproc SPLIT arm stays beside it as the control, so "did the transport break
it" and "did the phase break it" remain separately answerable.

Five defects stood between the handshake and that picture. Each one was
silent in its own way, and none of them looked like what it was.

1. THE DOORBELL COULD NOT WAKE ITSELF. SocketDoorbell's one-fd form sends on
   the end it polls, so a write is delivered to the PEER - correct for waking
   the other process, useless for waking a thread in this one. The server's
   control pump posts into the apply thread's mailbox and must ring the bell
   that thread parks on. Symptom: every eglInitialize crossed, landed in the
   mailbox, and timed out at 5 s. The two-fd form (park on [0], notify on [1])
   is restored here, and the bell handover goes from two descriptors to THREE
   - the client needs the same split for the same reason. Seven offers now.

2. InitCapabilities HAD NO WIRE KIND. CONTRACT-P6 §2 predicted this exactly
   ("the request has a live client caller and the codec refuses to encode
   it"). SurfaceOpKind gains 11, append-only; the decode range's upper bound
   moves with it, or the new tag reads as out-of-range and surfaces as
   Fatal{ProtocolCorruption} rather than the missing row it is. The op's name
   loses its InprocOnly suffix, which stopped being true here.

3. THE CHILD LOADED NO CONFIG AT ALL. mobilegl_server_main calls
   InitServerRoleForSpawn directly, and MG_ConfigLoader::Init is a step of
   MobileGL::Initialize - so every MG_Config value in the server was its
   static default. MOBILEGL_BACKEND_TYPE survives the launcher's scrub on
   purpose and was read by nobody: a DirectVulkan session would have brought
   up a DirectGLES server and then disagreed with its client about which
   backend the capability mask describes.

4. AND THEREFORE Transport READ AS Monolith, which CONTRACT-P6 §3.1 (D1)
   forbids in as many words. a6 measured the cost: 226 live lines test
   `Transport != Monolith` to select the SERVER arm, 148 in MG_Backend.
   Monolith flips all of them to frontend glue in the one process with no
   frontend. Observed precisely as predicted - UnitTexturesByHandle() answered
   false, Clear took the legacy arm that dereferences borrowed FRONTEND slot
   pointers, and the apply thread took a SIGSEGV inside SyncNeccessaryTextures
   on the first Clear record of the trace. It is pinned in-process rather than
   through the environment because the environment is where it must NOT be:
   LooksLikeAClientEnvironment exits 65 on a surviving MOBILEGL_TRANSPORT, and
   that check is anti-recursion catch (b). Dial, not Transport, is that axis.

5. THE LOG WAS CORRUPT, NOT MERELY INTERLEAVED. Two processes opened the same
   MOBILEGL_LOG_FILE_PATH with "w" and each carried its OWN file offset, so
   they overwrote each other's bytes - half-lines like `ote client: CapsMirror
   generation 1 adopted`, and the server's whole startup block vanishing under
   the client's later writes. This cost real diagnosis time twice, because a
   missing line read as a code path not taken. O_APPEND now; the client still
   truncates once so a fresh run is not a pile of old ones, and the server
   never does - it would delete the very startup lines a failed session needs.
   run_trace_case.cmake's Fatal{ census reads exactly this file, so it was
   also reading a lie.

The retrace runner's split assertions become transport-aware: one row per
transport it admits, and a transport with no row is a FATAL rather than a
fall-through, because the fall-through is the accident the block exists to
prevent. The spawn row carries a SECOND sentence and it is the stronger half
- ConfigLoader's marker proves the value RESOLVED, while `spawn ARMED - the
server role runs in pid N` is written only after the launch, the connect and
the handshake all succeeded, and carries a pid that is not this process's.
inproc resolves its own marker while running the server role on a thread
here; nothing on that path can write this one.

G14: one test name added (TheEleventhFramedOpIsInitCapabilitiesAndItCrosses-
TheWire), none removed. The ten-op table keeps its name and its scope rather
than being renamed to eleven.

Two unit failures predate this change and are environmental in this tree:
PipeCatalogue.FrontendNeverTakesAnApplierAddress (the frontend source root
resolves empty) and SessionHandshakeTest.TheAbiFingerprintChangesWhenAnyOf-
ItsInputsDoes (GIT_COMMIT_HASH_SHORT is empty here, which a6 already recorded
as red in this configuration).

MobileGL/ConfigLoader.cpp

@@ -336,10 +336,32 @@ namespace MobileGL::MG_ConfigLoader {
         }
         // The three P6 forms. Recognised precisely, so the diagnostic can say "not yet"
         // rather than "unknown", which are different bugs on the operator's side.
-        if (lowered == "spawn" || lowered.compare(0, 5, "unix:") == 0 ||
-            lowered.compare(0, 5, "pipe:") == 0) {
-            MGLOG_E("Config: MOBILEGL_TRANSPORT='%s' names a transport P6 implements and P5 does "
-                    "not; staying on monolith. This run is NOT a split run.",
+        // P6 `sm`/`cp`: spawn is IMPLEMENTED. It launches a server process on a
+        // rendezvous of its own and connects to it - the two processes are
+        // independent, so this is `Dial = Connect` with a launcher attached
+        // rather than the fork-coupled shape ARCHITECTURE.md:488 described.
+        if (lowered == "spawn") {
+            MG_Config::Transport = MG_Config::TransportMode::Spawn;
+            // THE SAME SHAPE AS THE inproc LINE ABOVE, AND FOR THE SAME REASON.
+            // run_trace_case.cmake asserts on a distinctive sentence from this
+            // function rather than on `MOBILEGL_TRANSPORT=spawn` alone, because
+            // ConfigLoader logs an `Accepted env variable: KEY=VALUE` line for
+            // every MOBILEGL_* in EVERY build including the pull one - so the
+            // bare KEY=VALUE is satisfied by a monolith library that parsed
+            // nothing (review M-5). A spawn arm with no line of its own could
+            // only have been asserted with the inproc marker, which spawn never
+            // emits: the arm would have been red for a missing sentence rather
+            // than green for a working transport.
+            MGLOG_I("Config: MOBILEGL_TRANSPORT=spawn - the MGPipe record stream crosses a real "
+                    "ring to an apply thread in ANOTHER PROCESS");
+            return;
+        }
+        if (lowered.compare(0, 5, "unix:") == 0 || lowered.compare(0, 5, "pipe:") == 0) {
+            // unix: and pipe: remain P6+ - connecting to an endpoint SOMEBODY
+            // ELSE is listening on needs the server lifecycle to be somebody
+            // else's too, which is P12's. Named, never a silent degrade.
+            MGLOG_E("Config: MOBILEGL_TRANSPORT='%s' names a transport P6 does not implement yet; "
+                    "staying on monolith. This run is NOT a split run.",
                     value.c_str());
             MG_Config::Transport = MG_Config::TransportMode::Monolith;
             return;