fix(scheduler-sim-diagnostics): bootstrap limit plugin in sim mode (bug-1825)

info limit was correctly implemented and tested but inert against a real
replay: register_limit()'s only call site was normal-mode sched_register_
plugins(); sim mode's own plugin bootstrap (sim_bootstrap_picker()) never
registered the limit plugin. The snapshot format already carries the
original session's limit config (sim->core.config, a borrowed reference set
by xce_sched_core_load_snapshot()) -- nothing needed to change in the
recording/replay format.

New sim_bootstrap_limit_plugin() (sim_limit.c, mirroring sim_picker.c's
structure) registers the plugin via plugin_register_core() and seeds it via
a new limit_seed_config(plugin, xce_sched_core_t* core, config) entry point,
wired into sim_loop.c alongside the existing sim_bootstrap_picker() call.
limit_new_plugin() extracted from register_limit() as a factory, mirroring
builtin_fcfs_new_plugin()'s established pattern; register_limit() itself is
behavior-preserving.

First attempt set plugin->sched to a disguised xce_sched_sim_driver_t*,
relying on it sharing xce_scheduler_t's first-member layout to reuse the
existing config_hook path -- rejected on review: this repeats the exact
cross-cast pattern that already corrupted memory once in this codebase (see
core.h's xce_core_cache_clear_cb_t history). Fixed by making
limit_seed_config() take xce_sched_core_t* as an honest parameter instead,
with limit_update_config() (normal mode) and the new sim path both
delegating to a shared limit_seed_config_impl() -- no cast, no aliasing risk,
independently verified by two review rounds reading the actual struct
layouts and call chains.

Also added sim_limit.c to sched_sim_isolation_lib so Req 5 AC 17's
controller-I/O-isolation check covers it (an initial gap, closed in the same
remediation round). Two ripple waves of the same established link-stub
pattern applied to the ~24 white-box test files that #include sim_loop.c.

info limit now shows real configured-limit data against a genuine replay.
Live usage will still correctly show "no active usage instance yet" until a
separate, larger fix (logged as bug-1826) wires limit *matching* into the
sim decision path -- deliberately out of this task's scope.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLSNJhNoULvVcUhXEFafQC

src/scheduler/meson.build

@@ -17,6 +17,7 @@ scheduler_srcs = [
   'src/sim.c',
   'src/sim_loop.c',
   'src/sim_picker.c',
+  'src/sim_limit.c',
   'src/sim_verify.c',
   'src/sim_record.c',
   'src/repl.c',
@@ -100,32 +101,37 @@ sched_core_isolation_lib = static_library(
 # the simulation driver's own files, consumed by
 # testsuite/test_sim_isolation.c to prove at build time that
 # sim.c/sim_loop.c/sim_record.c/repl.c/repl_fmt.c/repl_break.c/repl_info.c/
-# repl_params.c/sim_picker.c reference zero controller-facing symbols
-# (client/netio/xceapi/delay/idgen). All files are compiled together into
-# ONE archive -- task 11.2 added sim_loop.c as a sibling file to task
-# 11.1's sim.c, task 11.5 added sim_record.c as a third, task 12.1 added
-# repl.c as a fourth, task 12.2 added repl_break.c/repl_info.c as a
-# fifth/sixth (task 12.2's own 800-line-cap split of repl.c's
+# repl_params.c/sim_picker.c/sim_limit.c reference zero controller-facing
+# symbols (client/netio/xceapi/delay/idgen). All files are compiled
+# together into ONE archive -- task 11.2 added sim_loop.c as a sibling
+# file to task 11.1's sim.c, task 11.5 added sim_record.c as a third, task
+# 12.1 added repl.c as a fourth, task 12.2 added repl_break.c/repl_info.c
+# as a fifth/sixth (task 12.2's own 800-line-cap split of repl.c's
 # breakpoint/state-inspection logic -- repl_internal.h's own "Why a split
 # at all" section has the full rationale), task 12.3 added repl_params.c
 # as a seventh (the same split, extended again for `snapshot`/`set`),
 # bug-1567's fix added sim_picker.c as an eighth (sim_loop.c's own
 # "zero line-budget headroom" -- same reason its siblings above exist --
 # so the fix's picker-registration + post-load picker-rebuild-walk logic
-# lives here instead of growing sim_loop.c past its cap), and the
+# lives here instead of growing sim_loop.c past its cap), the
 # scheduler-sim-repl-verbosity spec's task 7.2 remediation added repl_fmt.c
 # as a ninth (repl.c's own 800-line-cap split of its shared, dependency-free
 # formatting helpers -- repl_fmt.c's own header comment has the full
-# rationale); covering only a subset of them would repeat core.c's own
-# siblings' (core_events.c/core_session.c/core_clock.c)
-# never-mechanically-covered gap for the sim driver. Same "compiling to an
-# object is enough, no real linking needed" rationale as
-# sched_core_isolation_lib above.
+# rationale), and the scheduler-sim-diagnostics spec's task 6 (bug-1825
+# fix, remediation round 2) added sim_limit.c as a tenth (sim_loop.c-cap
+# sibling housing sim_bootstrap_limit_plugin(), mirroring sim_picker.c's
+# own bootstrap-function role exactly) -- covering only a subset of them
+# would repeat core.c's own siblings' (core_events.c/core_session.c/
+# core_clock.c) never-mechanically-covered gap for the sim driver, which is
+# exactly the omission a prior round of this same task left in place by
+# adding sim_limit.c to scheduler_srcs above without also adding it here.
+# Same "compiling to an object is enough, no real linking needed" rationale
+# as sched_core_isolation_lib above.
 sched_sim_isolation_lib = static_library(
     'sched_sim_isolation',
-    ['src/sim.c', 'src/sim_loop.c', 'src/sim_picker.c', 'src/sim_record.c',
-     'src/repl.c', 'src/repl_fmt.c', 'src/repl_break.c', 'src/repl_info.c',
-     'src/repl_params.c', 'src/repl_rollup.c'],
+    ['src/sim.c', 'src/sim_loop.c', 'src/sim_picker.c', 'src/sim_limit.c',
+     'src/sim_record.c', 'src/repl.c', 'src/repl_fmt.c', 'src/repl_break.c',
+     'src/repl_info.c', 'src/repl_params.c', 'src/repl_rollup.c'],
     include_directories: incdir,
     dependencies: scheduler_deps,
     install: false)