fix(windows-drivers): pf-vdisplay robustness — AdapterInitStatus gate, pooled-device TDR check, MMCSS-optional worker

Batch B of the audit's medium tier (M4+M5+M6):

- M4: adapter_init_finished now reads AdapterInitStatus (was ignored) and
  only stashes the adapter on NT_SUCCESS, per the MS sample. A failed async
  init previously produced a HUSK adapter: monitors created on it arrive
  but the OS never assigns a swap-chain — every session black-screens with
  no visible cause (the exact signature live fault-injection produced after
  a WUDFHost kill). Unset adapter → ADD fails cleanly (host-retryable) and
  a re-entrant D0 retries the init; the status is now in the debug log.
- M5: pooled_device checks GetDeviceRemovedReason on a cache hit — a TDR'd
  device was returned for its LUID forever (SetDevice fail-loop, black
  virtual display until device teardown); now it falls through to a fresh
  create.
- M6: an AvSetMmThreadCharacteristicsW failure no longer aborts the worker
  before draining (which stalled the monitor and leaked the WDF swap-chain
  object) — continue unprioritized like the MS sample; revert only if MMCSS
  actually engaged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/windows/drivers/pf-vdisplay/src/swap_chain_processor.rs

@@ -117,9 +117,18 @@ impl SwapChainProcessor {
             // SAFETY: `w!("Distribution")` is a 'static null-terminated UTF-16 task name; `av_task` is a
             // valid local out-param. The returned handle is reverted with AvRevertMmThreadCharacteristics.
             let res = unsafe { AvSetMmThreadCharacteristicsW(w!("Distribution"), &mut av_task) };
-            let Ok(av_handle) = res else {
-                dbglog!("[pf-vd] swap-chain: failed to prioritize thread: {res:?}");
-                return;
+            // MMCSS can fail under the restricted WUDFHost token ('Distribution' task unregistered /
+            // service unavailable). The MS sample CONTINUES unprioritized — never abort: returning
+            // here would leave the assigned swap-chain undrained (the monitor stalls, DWM blocks on
+            // it) and leak the WDF swap-chain object until device teardown.
+            let av_handle = match res {
+                Ok(h) => Some(h),
+                Err(e) => {
+                    dbglog!(
+                        "[pf-vd] swap-chain: MMCSS prioritization failed ({e:?}) — continuing unprioritized"
+                    );
+                    None
+                }
             };
 
             Self::run_core(
@@ -144,12 +153,14 @@ impl SwapChainProcessor {
                 call_unsafe_wdf_function_binding!(WdfObjectDelete, swap_chain.0 as WDFOBJECT);
             }
 
-            // Revert the thread to normal once it's done.
-            // SAFETY: `av_handle` is the live characteristics handle returned by AvSetMmThreadCharacteristicsW
-            // above, reverted exactly once here at thread exit.
-            let res = unsafe { AvRevertMmThreadCharacteristics(av_handle) };
-            if let Err(e) = res {
-                dbglog!("[pf-vd] swap-chain: failed to revert prioritized thread: {e:?}");
+            // Revert the thread to normal once it's done (only if MMCSS was actually engaged).
+            if let Some(h) = av_handle {
+                // SAFETY: `h` is the live characteristics handle returned by
+                // AvSetMmThreadCharacteristicsW above, reverted exactly once here at thread exit.
+                let res = unsafe { AvRevertMmThreadCharacteristics(h) };
+                if let Err(e) = res {
+                    dbglog!("[pf-vd] swap-chain: failed to revert prioritized thread: {e:?}");
+                }
             }
         });