Debugger: report structured breakpoint hits, including log-only ones

A breakpoint hit reached a WebSocket client as two fields on cpu.stepping: a
reason string and one address. Everything else the hit site knew was formatted
into a log line and dropped.

What was missing per kind:

- exec: hit count, condition, symbol.
- memory: the address actually accessed, read vs write, size, and who did it.
  The address that reached the client was the *start of the watched range*, so a
  client watching 4KB learned only that something in it was touched.
- register: which register. Entirely - the event carried pc and nothing else.

There's now a BreakpointHit captured where the hit happens and carried through
Core_Break() on the stepping reason, rendered as a "hit" object on cpu.stepping.
It's absent rather than empty when the break wasn't a breakpoint (a pause, a
savestate load, an exception), so presence is the test. relatedAddress keeps
reporting the range start for compatibility; hit.address is the accurate one.
The formatter is shared with the new event below, so the two can't drift.

And a new cpu.breakpoint.hit broadcast fires on *every* hit whose condition
passes, whether or not it stops the CPU. That's the part that makes log-only
breakpoints usable for automation: until now their only trace was a line in the
log stream, so a client couldn't count hits, or react to one, without scraping
text. Same "hit" object, plus a sequence number.

Volume needed handling, since a log-only breakpoint in a hot loop produces
events far faster than a connection drains them - measured 13719 hits in three
seconds of one homebrew's draw function. The per-connection queue is capped and
drops rather than growing without bound, and the sequence number is what makes
that honest: a gap tells a client exactly how many it missed. Clients that don't
want the traffic at all can disallow the new "breakpoint" broadcast category.
Building the hit record is skipped entirely when no debugger is connected, which
is one relaxed atomic load on that path.

Verified against a running game, all three kinds. The memory case shows why the
address/range split matters - accessed address 200540160 against a watched range
starting at 200941120, with source "ThreadFillStack" identifying the HLE call
responsible.

libretro gets stubs: it builds Core.cpp and Breakpoints.cpp but not
Core/Debugger/WebSocket.cpp.

pspautotests 314/314, UnitTest 55/55.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZq8ZtJmFY7bkX5FVkr3P9

Core/Core.cpp

@@ -190,6 +190,9 @@ volatile bool coreStatePending = false;
 static bool powerSaving = false;
 static bool g_breakAfterFrame = false;
 static BreakReason g_breakReason = BreakReason::None;
+// Detail about the breakpoint that caused the current break, if it was one. Guarded by g_stepMutex
+// alongside g_cpuStepCommand, which is what it belongs to.
+static BreakpointHit g_breakHit;
 
 static MIPSExceptionInfo g_exceptionInfo;
 
@@ -587,7 +590,7 @@ static bool Core_ProcessStepping(MIPSDebugInterface *cpu) {
 }
 
 // Free-threaded (hm, possibly except tracing).
-void Core_Break(BreakReason reason, u32 relatedAddress) {
+void Core_Break(BreakReason reason, u32 relatedAddress, const BreakpointHit *hit) {
 	const CoreState state = coreState;
 	if (state != CORE_RUNNING_CPU) {
 		if (state == CORE_STEPPING_CPU) {
@@ -628,6 +631,12 @@ void Core_Break(BreakReason reason, u32 relatedAddress) {
 		CoreTiming::SetBreakDeadlineUs(0);
 
 		g_breakReason = reason;
+		// Cleared rather than left alone when there's no hit, so the detail from an earlier
+		// breakpoint can't be reported against, say, the user pressing pause afterwards.
+		if (hit)
+			g_breakHit = *hit;
+		else
+			g_breakHit = BreakpointHit{};
 		g_cpuStepCommand.type = CPUStepType::None;
 		g_cpuStepCommand.reason = reason;
 		g_cpuStepCommand.relatedAddr = relatedAddress;
@@ -694,6 +703,7 @@ SteppingReason Core_GetSteppingReason() {
 	// genuinely nothing to report.
 	r.reason = g_cpuStepCommand.reason;
 	r.relatedAddress = g_cpuStepCommand.relatedAddr;
+	r.hit = g_breakHit;
 	return r;
 }