feat: U2 UTRW slow path real branches

- slow_path.c: KEY_MISS -> PCKC re-derive (retry OK); EPOCH -> refresh cap epoch via out_cap (retry OK); STALE_CAP permanent; MAC_FAILED/POISONED -> PCKC invalidate + DRR fault report; RETRY passthrough
- status.h: add UTSM_ERR_MAC_FAILED (-11); utrw.h: slow path takes cap/rights/offset/len/reason + out_cap
- selftest: EPOCH refresh + KEY_MISS re-derive + POISONED passthrough coverage, full SELFTEST PASS in QEMU (.build_tmp/qemu_serial_u2slowpath.log)

CODE/UTSM/include/utsm/status.h

@@ -12,7 +12,8 @@ typedef enum {
     UTSM_ERR_KEY_MISS = -7,
     UTSM_ERR_STATE = -8,
     UTSM_ERR_POISONED = -9,
-    UTSM_ERR_RETRY = -10
+    UTSM_ERR_RETRY = -10,
+    UTSM_ERR_MAC_FAILED = -11   /* U2: 页 MAC 校验失败（slow path 处置） */
 } utsm_status;
 
 #endif