shim-sgx: batch page commits and tolerate EPCM permission races

[rishabhBudhouliya]

Fixes #20. The composed case from #16 (gcc + IMFS grate + SGX) now compiles hello.c end to end.

What was hanging

The shim commits enclave memory one page per page fault, and each commit is its own mmap of /dev/sgx_enclave. Device mappings never merge, so every touched page stays a VMA. gcc through the IMFS grate touches about 4 GiB, about 1M pages, and vm.max_map_count on lind-server-3 is 1,048,576. At the cap mmap_host returns ENOMEM, the handler panics, and a shim panic is loop {} holding the HEAP lock. Every other thread that faults then spins too, which is the "three threads at 100% CPU, no output, always at the same point" signature we had been chasing.

Live measurement on the wedged process: 1,048,578 VMAs, 1,048,100 of them /dev/sgx_enclave.

Change

1. handle_page_fault commits up to 64 pages per fault, limited to the rest of the ledger record containing the faulting page, and only when that record has the same access and is not yet MMAPPED. New Heap::record_at() exposes that record. Ledger::contains() cannot be used for this check because it ANDs access bits across records and would make a mixed committed/uncommitted window look uniform (a first version did this and re-EACCEPTed committed pages).
2. PROTECTION_VIOLATION|SGX faults on already committed pages with ledger-granted access are repaired (accept pending restrict, extend to the ledger's permissions) and retried, instead of being rejected. We hit this race once in an earlier run.
3. The panic paths in the handler print their state unconditionally, since the alternative is a silent spin.