fix: DMA ch2 GPU→RAM now reads GPUREAD instead of writing zeros

The VRAM-to-RAM DMA path (channel 2, direction 0) was stubbed to fill
the destination buffer with zeros. This broke all offscreen VRAM
readback — the BIOS shell draws spiral/splash textures to an offscreen
VRAM region, then DMA-transfers the rendered pixels back to RAM for
later use as texture atlas entries. With the stub, all texture buffers
stayed zero, producing invisible button backgrounds.

Fix: call gpu_read_gpuread() for each DMA word instead of writing 0.

Also includes: CDROM GetID two-phase response fix, GPU raw texture
mode fix (opcode bit 0 instead of color==0x808080), debug server
A0/C0 upload history commands with CPU context capture, and extended
write trace ranges.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

runtime/include/debug_server.h

@@ -133,6 +133,11 @@ int debug_server_get_input_override(void);
 /* Set the CPU state pointer for register queries. Call after CPU init. */
 void debug_server_set_cpu(CPUState *cpu);
 
+/* Global CPU pointer — set by debug_server_set_cpu(). Available for
+ * hardware simulation modules that need to read CPU state (e.g. GPU
+ * capturing stack values during A0 uploads). */
+extern CPUState *debug_cpu_ptr;
+
 void debug_server_send_line(const char *json);
 void debug_server_send_fmt(const char *fmt, ...);