fix(queue): close virtqueue notification races

[fslongjin]

Summary

• track whether device-to-driver notifications are enabled so consuming used entries cannot accidentally undo EVENT_IDX suppression
• add prepare/check APIs for closing the callback enable race across VirtIO net RX and TX queues
• validate the actual full-width u32 used descriptor ID before narrowing or recycling descriptors
• allocate raw net virtqueues directly on the heap when alloc is enabled, avoiding large Q64 queue objects on kernel stacks
• add regression coverage for EVENT_IDX disable/pop behavior and malformed used IDs

Root cause

With VIRTIO_F_RING_EVENT_IDX negotiated, disabling callbacks wrote a suppressed used_event, but every subsequent pop_used() unconditionally advanced used_event again. NAPI-style polling therefore reopened the interrupt stream partway through a bounded poll, causing IRQ/MISSED churn. In addition, raw net code validated a peeked used ID separately from the ID consumed by pop_used(), leaving a TOCTOU window and narrowing an untrusted u32 ID too early.

Impact

VirtIO net drivers can now implement the standard disable/poll/enable/recheck handshake without losing the callback state or accepting an invalid descriptor token. Queue construction for larger raw-net rings also avoids avoidable kernel-stack pressure.

Validation

• cargo fmt --all -- --check
• RUSTFLAGS='--cap-lints=warn' cargo test
  • 27 unit tests passed
  • 8 doctests passed
• git diff --check

The --cap-lints=warn setting is required only because the repository's existing fake transport test module triggers pre-existing missing_docs lints.