Route DebuggerController operations through a per-controller worker queue

[xusheng6]

Supersedes #1087 (the prior PR was auto-closed when the branch was renamed for CI to pick it up).

Summary

Two stacked commits:

1. Worker-queue refactor. Replace the per-operation std::thread(...).detach() pattern (17 sites in Launch/Attach/Connect/Go/GoReverse/Step…/RunTo…/Restart/Detach/Quit/Pause) with one persistent worker thread per controller plus a FIFO work queue. Every public op routes through Submit() / SubmitAndWait(). The worker is owned by the controller and joined in the destructor (after draining), so async work cannot outlive the controller — lifetime is structural rather than reliant on per-call DbgRef captures.
2. Adapter-stop channel. Adapter stops are now an internal signal from the adapter thread to the worker (m_adapterStopMutex / m_adapterStopCv / m_adapterStopPending), not events on the public dispatcher queue. The conditional-breakpoint silent-resume logic moves into ExecuteAdapterAndWait, eliminating the previous "drive m_adapter->Go() from the dispatcher thread" hack and the m_suppressResumeEvent flag that papered over it. Spontaneous adapter stops (user types si directly into the LLDB REPL while no controller op is in flight) are detected via m_inAdapterWait and routed through the worker queue.

Implements #1088, #1089.

Design notes (worker queue)

• Submit detects re-entrant calls from the worker itself (std::this_thread::get_id() == m_workerThreadId) and runs them inline — lets RestartAndWaitOnWorker call QuitAndWaitOnWorker + LaunchAndWaitOnWorker without deadlocking.
• SubmitAndWait submits a task and blocks on the future. Every XxxAndWait now takes an optional std::chrono::milliseconds timeout (default milliseconds::max() = wait forever, bypasses wait_for to avoid stdlib overflow). On non-infinite timeout: signals m_adapter->BreakInto() and still waits for the in-flight op to settle.
• Public/Internal/OnWorker split. The existing XxxAndWaitInternal does the actual work; the old XxxAndWait (lock + Internal + notify) is renamed XxxAndWaitOnWorker (private) and invoked from the worker; the new public XxxAndWait(timeout) is a one-line SubmitAndWait wrapper.
• Pause() / PauseAndWait() bypass the queue and call m_adapter->BreakInto() directly on the caller's thread — the worker is blocked inside ExecuteAdapterAndWait for whatever resume op is in flight; BreakInto unsticks it.

Design notes (adapter-stop channel)

• PostDebuggerEvent intercepts AdapterStoppedEventType and routes the reason to the internal channel. If m_inAdapterWait is true the in-flight ExecuteAdapterAndWait consumes it; otherwise the stop is queued on the worker as a spontaneous handler.
• ExecuteAdapterAndWait claims the channel for its entire duration (including the silent-resume loop), so a stop between iterations is still consumed by us, not synthesized as spontaneous.
• TargetExitedEventType / DetachedEventType still go through the dispatcher queue (user-visible) but also signal the adapter-stop channel so any in-flight WaitForAdapterStop unblocks when the target dies.
• Deleted: m_lastAdapterStopEventConsumed, m_suppressResumeEvent, the temporary RegisterEventCallback/Semaphore pattern inside ExecuteAdapterAndWait, the dispatcher's entire AdapterStoppedEventType-specific block, and the Go-from-dispatcher hack.
• AdapterStoppedEventType stays in the public enum so adapters keep posting it the same way. Zero source changes across the 8 adapters.

Public API compatibility

• Every public method keeps its existing signature; sync XxxAndWait only gains an appended optional timeout parameter defaulted to infinite. Existing callers in core/ffi.cpp and ui/uinotification.cpp don't change.

Spontaneous-stop case (e.g. si typed in the LLDB REPL)

When the user issues a command directly to the underlying adapter REPL while no controller op is queued, the engine runs and stops. m_inAdapterWait is false at that point, so PostDebuggerEvent Submits HandleSpontaneousAdapterStop onto the worker, which updates caches and calls NotifyStopped — same observable behavior as the dispatcher synthesis the old code did at debuggercontroller.cpp:2279, just on the worker. Only one engine op can run at a time, so an adapter stop is unambiguously either "the response to whatever the worker last asked for" (consumed by WaitForAdapterStop) or "the user did this themselves while we were idle" (queued as spontaneous).

Out of scope (follow-ups)

• Adapter-internal threads: DbgEngAdapter::Attach's spawned thread (BINARYNINJA-1A), DbgEngAdapter::EngineLoop, LLDB EventListener, RSP send/receive. These need adapter destructors to act as join barriers — separate from controller-side scheduling.
• m_targetControlMutex cleanup. Redundant once the queue serializes work, but left in place to minimize behavioral risk.
• BinaryDataNotification / settings notification unregister in Destroy (BINARYNINJA-75, -2H — the RebaseToAddress family).
• m_userRequestedBreak should become std::atomic<bool> now that Pause writes it from a non-worker thread.

Test plan

• Builds cleanly (ninja — both libdebuggercore.dylib and libdebuggerui.dylib)
• Manual: launch, step, hit breakpoint, pause while running, detach mid-step, close tab mid-operation
• Verify spontaneous-stop case: type si directly into LLDB while idle, confirm UI updates
• Conditional breakpoint with false condition: confirm silent resume still works
• IL stepping: confirm step-into HLIL only surfaces one stop per user request
• Python regression tests in test/debugger_test.py

🤖 Generated with Claude Code