[MG_Pipe, MG_Remote, MG_Backend, MG_Test] (Disaggregated): P5e ID-128 - admission gains the escalation disjunct

- The integrator's census over the merged tree left two markers nothing admitted, both
  DirectGLES.Split.ClientVertexArrayScenario: GetBoundVertexArray@DrawArrays. Disjunct 1 fails
  (draw_vbo is kWaitNone) and disjunct 2 fails (that row's retiring phase names P5e, correctly,
  for the ORDINARY draw path vi and mv retired). But these two entries pull the pair on a record
  the client IS parked behind: MGPipeBarriered escalates a draw carrying client vertex arrays
  (ID-83), ID-82 puts client arrays outside P5e entirely, and the read site
  (SyncClientSideVertexArraysForDrawArrays) aborts by its own name if it is ever applied
  unbarriered. The pull is legal; no static table could see it.
- Third disjunct: the record was barriered BY ESCALATION, i.e. wireSaysBarriered(op, payload,
  applierState) && MGPipeWaitClassFor(op) == kWaitNone. Both halves were already computed on
  every record - ApplyOne computes the predicate unconditionally for ID-103's reason - so this is
  one more bit stamped beside the barriered stamp, not new plumbing.
- It is a SEPARATE flag rather than a refinement of the barriered stamp, because the two answer
  different questions: the stamp answers "is the client parked" (the allocator and registry
  guards ask that), this answers "and for a reason the static table cannot see" (only the strict
  knob asks). Its default is false - the answer that admits nothing - which is the opposite of
  the stamp's default and deliberately so.
- The marker says WHICH disjunct: ADMITTED when the generated table answered, ADMITTED-ESCALATED
  when only the record did. That keeps the lane's comparison against --print-admitted exact
  instead of widening the static list with every pair that could ever escalate - and the tag sits
  in the slot the grammar already has for the reason, so Fatal{UnmigratedPipeInput filters are
  untouched.
- Escalation also happens to be the truer justification for GetTransformFeedbackProgram@DrawArrays,
  which ID-125 admits by phase. Both now hold; ID-125's disjunct is kept, as ruled.
- Red-once: AnEscalatedRecordsPullIsAdmittedAndSaysWhy. Dropping `&& !escalated` from the strict
  arm kills it - "FieldOwnershipTest.cpp:938: Failure / Actual: false / signal 6" with
  'Fatal{UnmigratedPipeInput, "GetBoundVertexArray@DrawArrays"} [BARRIER-PULLED,
  MOBILEGL_IPC_STRICT_ERRORS=1, retires in P5e (Espryt unbarriered), P7 (Magma)]'. Its control is
  StrictErrorsTurnsABarrierPulledReadIntoANamedAbort, which drives the identical pull with the
  flag at its default and must keep aborting.

MobileGL/MG_Remote/Server/PipeApplier.cpp

@@ -1199,6 +1199,17 @@ namespace MobileGL::MG_Remote::Server {
         MG_Pipe::MGPipeApplierSetCurrentRecordBarriered(
             MGPipeApplierStampsBarriered(MG_Pipe::kMGPipeP5eClientWaitRuleLanded,
                                          MGPipeServerPublishesRunAhead(), wireSaysBarriered));
+        // P5e (gl), ID-128: AND WHETHER IT WAS BARRIERED BY ESCALATION RATHER THAN BY ITS CLASS.
+        // The predicate above is the static wait class plus two payload-derived escalations
+        // (ID-83: an open transform-feedback span, a draw carrying client vertex arrays), so the
+        // difference between it and the table IS the escalation - both halves are already
+        // computed here, and the second flag costs one compare. The strict knob is the only
+        // reader: a pull on an escalated record is a debt the phase that owns XFB (§5.7) or
+        // client arrays (ID-82) owes, neither of which is this one.
+        MG_Pipe::MGPipeApplierSetCurrentRecordBarrieredByEscalation(
+            wireSaysBarriered &&
+            MG_Pipe::MGPipeWaitClassFor(static_cast<MG_Pipe::MGPWireOp>(record.kind)) ==
+                MG_Pipe::kWaitNone);
         // ORDER IS THE CONTRACT'S: stamp, then apply. The stamp is what makes any server-side
         // read of gPipeInputs legal at all (PipeApplier.h's block 1), so a record applied
         // before it aborts on the FIRST field inside SyncRenderState.