Fix cold ARP packet delivery

[ryanbreen]

Summary

• queue outbound IPv4 packets on ARP miss instead of dropping the first TCP SYN
• flush pending packets when ARP learns a sender mapping
• mask the pending queue lock with irq_save/irq_restore for TX vs NetRx softirq access

Validation

• cargo build --release --features testing,external_test_bins --bin qemu-uefi (0 warning/error lines)
• cold Parallels autorun bssh to 10.211.55.2: ARP miss -> authenticated -> Darwin -> rc=0 -> PID 8 exit
• inbound SSH to Breenix ran nested outbound bssh to 10.0.1.210: Darwin, rc=0, ssh_exit=0
• NetRx samples after cycle stayed balanced: sample 2 ENTRY=81 EXIT=81 HELD=0; sample 3 ENTRY=82 EXIT=82 HELD=0; sample 4 ENTRY=82 EXIT=82 HELD=0

Artifacts: /Users/wrb/Downloads/Ralph/breenix-interrupt-io-roadmap-1780056222/turn98-artifacts/arp-pending-queue/proof-summary.md

Note: cargo fmt --check currently fails on unrelated pre-existing formatting/trailing-whitespace issues in tests/shared_qemu.rs and other files; this PR leaves them untouched.