fix: catalyst poll — set driver_override + drivers_probe in poll loop

After fire-and-poll clears the driver symlink (~2s), the device has no
driver_override set (still "nvsov" from deferred_insmod). vfio-pci won't
auto-claim without correct override + probe.

Catalyst warm_swap now polls with guarded override+probe writes (5s
timeout each, retry on failure). On GV100: override set in 50ms,
probe sent in 50ms, vfio-pci bound within 5s. Total warm_swap: 7s.

Full pipeline timings on fresh boot:
  insmod nvsov:     400ms
  catalyst capture: instant (20 registers)
  fire-and-poll:    2s (driver symlink cleared)
  poll for vfio:    5s (override+probe+rebind)
  BAR0 snapshot:    ~1s (173K registers, 18 domains)
  rmmod nvsov:      100ms

Known remaining gap: post-swap steps (sibling rebind, tier classify,
BAR0 capture) can block 5-7min when nvidia RM teardown child is still
running in the kernel background. The PCI lock contention delays sysfs
operations. The BAR0 capture itself is fast once it starts.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ecoPrimal

crates/core/cylinder/src/vfio/sovereign_handoff.rs

@@ -1064,30 +1064,57 @@ pub fn execute_handoff(
     }
 
     if is_catalyst {
-        // After fire-and-poll, the driver symlink is gone but nvidia RM
-        // teardown still holds the PCI device lock. Any sysfs write
-        // (override, probe) would block until teardown finishes.
-        // Instead, poll for the final driver to appear — vfio-pci auto-
-        // claims via boot config once the lock releases.
+        // After fire-and-poll, the driver symlink clears in ~2s but nvidia
+        // RM teardown still holds the PCI lock for 160-400s. We need to:
+        //   1. Wait for driver=None (done by fire-and-poll)
+        //   2. Set driver_override to final_driver via guarded write (may
+        //      block until PCI lock releases — use 5s timeout, retry)
+        //   3. Write drivers_probe to trigger rebind
+        //   4. Poll for final_driver to appear
         let poll_deadline = deadline.saturating_sub(overall.elapsed());
         let poll_start = Instant::now();
-        let poll_interval = Duration::from_secs(2);
+        let poll_interval = Duration::from_secs(5);
+        let mut override_set = false;
+        let mut probe_sent = false;
         let mut final_driver = guarded_sysfs::read_current_driver(&config.bdf);
 
         while final_driver.as_deref() != Some(config.final_driver.as_str()) {
             if poll_start.elapsed() >= poll_deadline {
                 steps.push(HandoffStep {
                     name: "warm_swap".into(), ok: false,
                     detail: Some(format!(
-                        "poll for {} timed out (driver={:?})",
-                        config.final_driver, final_driver,
+                        "poll for {} timed out (driver={:?}, override_set={}, probe_sent={})",
+                        config.final_driver, final_driver, override_set, probe_sent,
                     )),
                     duration_ms: t.elapsed().as_millis() as u64,
                 });
                 return halt_result(&config.bdf, "warm_swap", steps, patch_result,
                                    module_loaded, false, overall, &sibling_state,
                                    &config.module_name, needs_device_rollback);
             }
+
+            if !override_set {
+                if let Ok(()) = guarded_sysfs::sysfs_write_guarded(
+                    &override_path, &config.final_driver,
+                    Duration::from_secs(5),
+                ) {
+                    override_set = true;
+                    tracing::info!(bdf = config.bdf.as_str(),
+                        "catalyst poll: driver_override set to {}", config.final_driver);
+                }
+            }
+
+            if override_set && !probe_sent {
+                if let Ok(()) = guarded_sysfs::sysfs_write_guarded(
+                    &probe_path, &config.bdf,
+                    Duration::from_secs(5),
+                ) {
+                    probe_sent = true;
+                    tracing::info!(bdf = config.bdf.as_str(),
+                        "catalyst poll: drivers_probe sent");
+                }
+            }
+
             std::thread::sleep(poll_interval);
             final_driver = guarded_sysfs::read_current_driver(&config.bdf);
         }