EXCLWAIT bitfield can overflow into SPINLOCK_SHARED bit; no bounds guard

Summary

Lock word packs bits 20-30 as EXCLWAIT(11 bits, max 2047), bit 31 as SHARED. Each waiter adds SPINLOCK_EXCLWAIT(0x00100000) via atomic_fetchadd(:206). No masking on add. 2048 waiters -> carry into bit 31 -> spurious SHARED -> mode confusion. Bounded by MAXCPU=256 (8x headroom). Not reachable today. Defense-in-depth.