cpu_mwait_cx_hint() NULL-pointer dereference when deep-sleep inhibition is active on a MONITOR-without-MWAIT-EXT CPU (latent kernel panic)

Summary

The inhibit fast-path derefs cpu_mwait_hints[0] without the CPU_MWAIT_HAS_CX guard while the idle loop only requires CPU_MI_MONITOR: on CPUs with CPUID.1 ECX MON but without CPUID.5 EXT/C1 sub-states the array is never allocated (cpu_mwait_attach returns early) - any cpu_inhibit_deep_sleep(1) (i915 pm_qos shim path) makes every CPU's idle loop read address 0. cpu_smp_stopped guards the same pointer; cx_hint forgot. Driver-mediated trigger, hang/panic ceiling; not constructible on the standard guest. Mirror-the-guard fix.