Recover movement scratch initialization and mode dispatch

RE-984. Focused validation: cargo xtask test-group qvm-client-move-scratch. Machine report.

Twelve original-QVM probes recover a 268-byte zero fill at frame+56, preserving four-byte guards on both sides. Mode10 requests152792 then152673; mode8 requests153419; other modes request neither. Zeroing precedes callbacks. Native memset is modeled with coherent byte writes; callback bodies and their state feedback remain unresolved.