applyGsDispEnv programs display read circuit 2 only

[smmathews]

Problem

applyGsDispEnv — the shared helper behind the sceGsPutDispEnv HLE and the
sceGsSwapDBuff/sceGsSwapDBuffDc double-buffer paths — translated a single
sceGsDispEnv struct into GS privileged register writes and programmed both
display read circuits: dispfb1/display1 and dispfb2/display2, from
the one-circuit env. Real libgraph sceGsPutDispEnv programs only PMODE,
SMODE2, DISPFB2, DISPLAY2 and BGCOLOR; the env describes read circuit 2,
and circuit 1 is left for the game to drive itself via GS privileged MMIO.

Titles that composite two different buffers (for example a movie/scene underlay
beneath a UI overlay, PMODE=0x8007) program DISPFB1/DISPLAY1 themselves.
The HLE's circuit-1 clobber forced both read circuits onto the same surface,
collapsing the blend.

Fix

ps2xRuntime/src/lib/Kernel/Stubs/Helpers/Support.h — applyGsDispEnv: deleted
the two circuit-1 assignments (regs.dispfb1 = env.dispfb; regs.display1 = env.display;)
and replaced them with an explanatory comment. PMODE, SMODE2, DISPFB2,
DISPLAY2, BGCOLOR are unchanged. The guest's own MMIO writes to
DISPFB1/DISPLAY1 now survive.

Collateral: double-buffer PMODE seeds

Making applyGsDispEnv circuit-2-only exposed the double-buffer seed helpers.
sceGsSetDefDBuffDc and sceGsSetDefDBuff
(ps2xRuntime/src/lib/Kernel/Stubs/GS.cpp) seeded PMODE = makePmode(1,1,...) = 0x8007 (both read circuits enabled), but the only thing that programs a display
circuit on the swap path is applyGsDispEnv(db.disp[which]), which post-fix
writes DISPFB2/DISPLAY2 only. So the double-buffer path drives circuit 2
exclusively; the buffer flip only ever moved circuit 2.

Before the fix the shared helper wrote both circuits, so each swap dragged
circuit 1 along in lockstep (equal to circuit 2) — the only reason EN1 ever
looked valid. Post-fix, circuit 1 would freeze at the runtime's reset defaults
(dispfb1 fbw=10, display1 639×447) while circuit 2 flipped, so the compositor
(ps2_gs_gpu.cpp) would blend that stale circuit-1 surface (fbp 0) over the
correct circuit-2 page for any title using the stock double-buffer library
without driving circuit 1 itself.

Remedy: seed the double-buffer PMODE with read circuit 2 only —
makePmode(1u, 1u, ...) → makePmode(0u, 1u, ...) at both sites, i.e.
0x8007 → 0x8006. A seed that enables a circuit the path never programs is
wrong; EN2-only matches real-hardware semantics, because plain libgraph
double-buffering is single-circuit (one visible circuit alternating
framebuffers). GsSetCrt / sceGsResetGraph, which enable EN1, also program
the circuit-1 registers consistently and are a different, correct code path —
left untouched.

Known residual (follow-up)

ps2_memory.cpp seeds the circuit-1/2 display reset defaults non-null (dispfb1 fbw=10, display1 639×447) instead of the null region a real GS reset leaves. That keeps the compositor's hasDisplaySetup gate true before circuit 1 is ever programmed, so a title that enables EN1 via raw MMIO without writing DISPFB1 would blend circuit 1's stale VRAM (page 0) over circuit 2 — garbage where hardware shows nothing.

Why not here: it's unreachable through the HLE paths this PR fixes (every HLE writer that sets EN1 also programs circuit 1; the double-buffer seeds are now EN2-only), so folding in an unrelated boot-defaults change would only widen the blast radius.

Suggested follow-up: zero the four display-circuit boot defaults in ps2_memory.cpp — the hardware-correct value — with a regression test (zero-init regs, PMODE=EN1 only, assert circuit 1 contributes no presentation frame). ~2 lines; it removes the root cause instead of masking it in the compositor, and the blast radius is contained (PMODE is already zero at boot, so nothing presents until a game programs it, and the GS tests supply their own register state).

Tests (ps2xTest/src/ps2_gs_tests.cpp)

Three tests cover the behavior, each asserting EN1==0 / EN2==1 and
circuit-1 sentinel preservation:

• sceGsPutDispEnv circuit-2-only: pre-seeds dispfb1/display1 sentinels,
  invokes the HLE with a known env, asserts circuit-2 + shared registers carry
  env values while the circuit-1 sentinels are untouched.
• sceGsSwapDBuffDc swap path: after sceGsSetDefDBuffDc + sceGsSwapDBuffDc,
  asserts the seeded PMODE does not enable read circuit 1 (EN1==0) and does
  enable read circuit 2 (EN2==1), and that pre-seeded circuit-1
  DISPFB1/DISPLAY1 sentinels survive the swap.
• sceGsSwapDBuff swap path: the non-Dc twin, driving sceGsSetDefDBuff +
  sceGsSwapDBuff with identical assertions so the non-Dc seed is directly
  exercised rather than relying on correct-by-symmetry.

The migrated sceGsSetDefDBuffDc test had its post-swap assertions corrected
from dispfb1/display1 to dispfb2/display2.

Verification

• ps2x_tests: 299 tests, 0 failed.
• Revert behavior: reverting the makePmode seeds back to (1,1)/0x8007 at
  both sites fails exactly the two swap-path EN1==0 assertions — one from the
  Dc test, one from the non-Dc test (297/299); restoring returns to 299/299.
• Build/toolchain note: GCC 16 host; verification build configured with
  -DPS2X_BUILD_STUDIO=OFF and -march=native -include cstdint in
  CMAKE_CXX_FLAGS (host-local only, not committed).