test: ipc: bug-test the long pf reply MR stomp issue
ipc: don't destroy exception originator's TCRs

Same for pagefaults, too.

Changes:
  - rework save_ipc_regs() and its hook function to use malloc(), and revise
    its interface to only save/restore BR0 but also always save
    Virtual/ActualSender and IntendedReceiver
  - remove saved_{regs,mrs,brs} from <struct thread>
  - keep the <struct saved_regs> pointer in an explicit union with the
    pre-activation pager TCR, and the kth dead_link
  - preserve <struct thread>'s ipc_from, ipc_to during faulting string
    transfers in fields next to ipc_state
  - save received MRs in do_ipc_transfer() when the hook isn't empty