runtime: cross-fiber longjmp fix + decouple vblank-present from MMIO read

Two distinct bugs were causing OPTIONS-black hard freezes after 12K-65K
frames:

1. interrupts.c + traps.c: exception_jmpbuf is a single global. setjmp
   captures the running fiber, but longjmp may be requested from a
   different fiber via psx_exception_longjmp / psx_restore_state_escape
   during chain-handler dispatch. Cross-fiber longjmp restores RSP to
   the wrong stack while Win32 still tracks the calling fiber, corrupting
   fiber state until SwitchToFiber eventually hangs.

   Fix: track g_exception_owner_fiber at setjmp time. New
   deferred_exception_longjmp checks the current fiber; if it's not the
   owner, sets a pending flag and SwitchToFiber's back to the owner.
   psx_change_thread_fiber's post-SwitchToFiber path observes the flag
   and executes the longjmp on the correct stack.

2. gpu.c: gpu_read_gpustat fired gpu_vblank_tick() after 1000 polls,
   which invoked sdl_vblank_present (SDL_Delay -> Sleep) from inside
   an MMIO read code path. That meant recompiled MIPS spent wall time
   in Sleep deep inside the fiber call tree -- confusing to reason
   about and a contributor to fiber/longjmp interactions.

   Fix: synthetic VBLANK from a poll-storm only updates emulation state
   (LCF + I_STAT). The host-side render+sleep happens only at the proper
   cycle-paced VBLANK trigger in psx_check_interrupts.

Also adds: dirty_block ring slice to the freeze auto-dump, Win32 main-
thread stack capture for wedge_kind=1 hard freezes (SuspendThread +
StackWalk64 + SymFromAddr), and dbghelp link.

Validated: TombaRecomp psx-runtime ran 30+ minutes / 105K+ frames at
OPTIONS with no hard freeze. Previous freezes consistently hit at
11900, 20493, and 64596 frames.

Diagnostic tooling under tools/_options_session/ that produced this
diagnosis is included.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

runtime/include/debug_server.h

@@ -12,6 +12,7 @@
 #define PSXRECOMP_V4_DEBUG_SERVER_H
 
 #include <stdint.h>
+#include <stdio.h>
 
 #include "cpu_state.h"
 
@@ -178,6 +179,27 @@ extern CPUState *debug_cpu_ptr;
 void debug_server_send_line(const char *json);
 void debug_server_send_fmt(const char *fmt, ...);
 
+/* ---- Freeze auto-dump accessors ----
+ *
+ * Called from the freeze_heartbeat thread (NOT from TCP). Each function
+ * writes a JSON array `[entry1,entry2,...]` of the newest `max_count`
+ * entries from its ring directly to the given FILE*. Caller wraps with
+ * the field name (e.g. "wtrace_all":[ ... ]).
+ *
+ * Thread-safety: best-effort. The heartbeat thread fires these only
+ * after detecting a main-thread stall, so concurrent writers are rare,
+ * but a wedged loop that still touches RAM could tear an entry near the
+ * ring head. Forensic value is in the bulk of older entries which are
+ * stable. */
+void debug_server_freeze_dump_wtrace_all_json(FILE *f, uint32_t max_count);
+void debug_server_freeze_dump_wtrace_json(FILE *f, uint32_t max_count);
+void debug_server_freeze_dump_frame_history_json(FILE *f, uint32_t max_count);
+void debug_server_freeze_dump_sio_pc_json(FILE *f, uint32_t max_count);
+void debug_server_freeze_dump_thread_trace_json(FILE *f, uint32_t max_count);
+void debug_server_freeze_dump_restore_trace_json(FILE *f, uint32_t max_count);
+void debug_server_freeze_dump_fn_entry_json(FILE *f, uint32_t max_count);
+void debug_server_freeze_dump_dirty_block_json(FILE *f, uint32_t max_count);
+
 #ifdef __cplusplus
 }
 #endif