boot/uefi: the memory map the kernel gets is the one the firmware agreed to

Two bugs on the ExitBootServices path, both invisible under OVMF and both
aimed squarely at real firmware.

The retry did not re-translate. If ExitBootServices returns an error the
loader re-reads the memory map and tries again -- correct, and the
specification expects it -- but the e820 table handed to the kernel was
still the one built from the *previous* map. The retry exists precisely
because the map changed, so the kernel was being given a description of
memory the firmware had already rearranged. QEMU never takes this path,
which is why it survived. Translation is now a function called on both.

Truncation was silent. phystop comes from the largest usable region, so
dropping the tail of the map can leave the kernel believing a large
machine has a fraction of its RAM -- and nothing said so, because the
loop simply stopped at the cap. It now warns while there is still a
console to warn on; after ExitBootServices there is nowhere to report
anything.

SCHBOOT_E820_MAX goes from 32 to 40. The map sits at BASE+0x208 and the
next field is at BASE+0x600, so 1016 bytes are reserved and 42 entries of
24 bytes fit. Real firmware emits far more descriptors than QEMU's; the
headroom was already allocated and unused.

Coalescing adjacent same-type runs is what keeps any of this in budget,
and it works because boot services memory becomes usable at this point --
that is most of the fragmentation in a UEFI map.

110 [ok], no failures, and the map still reads 7 regions under OVMF.

include/schboot.h

@@ -71,7 +71,11 @@
 // 0x508, which is what leaves 0x600 free below.
 #define SCHBOOT_E820_COUNT    (SCHBOOT_BASE + 0x200)
 #define SCHBOOT_E820_MAP      (SCHBOOT_BASE + 0x208)
-#define SCHBOOT_E820_MAX      32
+/* 40, not 32. The map lives at SCHBOOT_E820_MAP (BASE+0x208) and the next
+ * field is SCHBOOT_RSDP_ADDR at BASE+0x600, so there are 1016 bytes and each
+ * entry is 24 -- 42 fit. Real UEFI firmware produces far more descriptors than
+ * QEMU's, and the headroom costs nothing that was being used. */
+#define SCHBOOT_E820_MAX      40
 
 // Where the loader leaves the ACPI RSDP, as a little-endian 64-bit physical
 // address. Zero means "not provided, go and look for it yourself".