feat: U2 UTRW slow path real branches

- slow_path.c: KEY_MISS -> PCKC re-derive (retry OK); EPOCH -> refresh cap epoch via out_cap (retry OK); STALE_CAP permanent; MAC_FAILED/POISONED -> PCKC invalidate + DRR fault report; RETRY passthrough
- status.h: add UTSM_ERR_MAC_FAILED (-11); utrw.h: slow path takes cap/rights/offset/len/reason + out_cap
- selftest: EPOCH refresh + KEY_MISS re-derive + POISONED passthrough coverage, full SELFTEST PASS in QEMU (.build_tmp/qemu_serial_u2slowpath.log)

CODE/UTSM/include/utsm/status.h

@@ -12,7 +12,8 @@ typedef enum {
     UTSM_ERR_KEY_MISS = -7,
     UTSM_ERR_STATE = -8,
     UTSM_ERR_POISONED = -9,
-    UTSM_ERR_RETRY = -10
+    UTSM_ERR_RETRY = -10,
+    UTSM_ERR_MAC_FAILED = -11   /* U2: 页 MAC 校验失败（slow path 处置） */
 } utsm_status;
 
 #endif

CODE/UTSM/include/utsm/utrw.h

@@ -7,6 +7,12 @@
 
 int utsm_read(utsm_capability cap, u64 offset, void *dst, u64 len);
 int utsm_write(utsm_capability cap, u64 offset, const void *src, u64 len);
-int utsm_slow_path(int reason);
+
+/* U2: Slow Path —— Fast Path 失败后的恢复分支。
+ * reason 为 Fast Path 返回的错误码；恢复成功返回 UTSM_OK（可重试），
+ * EPOCH 场景经 out_cap 回传刷新后的凭证（可为 NULL）。
+ * 其余返回值为不可恢复错误。 */
+int utsm_slow_path(utsm_capability cap, u32 rights, u64 offset, u64 len,
+                   int reason, utsm_capability *out_cap);
 
 #endif