docs(time-model): draft the upstream QEMU report for the replay-flush patch

[darwin67]

Adds poc/time-model/qemu-nosleep-replay-upstream.adoc and indexes it from docs/time-model.adoc beside the patch and the evidence. Docs-only: no code, no build change, and the patch file is untouched.

This is a draft for the owner to submit. Nothing has been sent to qemu-devel@nongnu.org and no external issue was opened; the Signed-off-by trailer is the submitter's to add.

What the report contains

• The subject and body a QEMU contributor would send ([PATCH] icount: flush replay async events with sleep=off), with the diff, which is identical to poc/time-model/qemu-nosleep-replay-flush.patch.
• The problem: -icount sleep=off is documented as giving "deterministic execution times from the guest point of view" and record/replay as recording and replaying serial port input, and the two do not compose.
• The mechanism and the exact ordering: replay_async_events() is the only site that drains the replay asynchronous event queue, and its only caller returns before it when icount_sleep is false.
• The minimal reproduction, re-measured for the report on the pinned QEMU 11.1.0 with and without the patch: stock drops the input and writes no EVENT_ASYNC_CHAR_READ to the recording, the patched build delivers it in record and replay, and the sleep=on control is unchanged.
• Why the flush can move without disturbing checkpoint ordering.
• The counter-arguments to expect, and the regression test proposed for QEMU's own functional record/replay suite (tests/functional/x86_64/test_replay.py, X86Replay on ReplayKernelBase, the TuxBoot Buildroot assets it already uses), plus what this project's probe already covers that the upstream test should not duplicate.

Verification

• make check-rfds passes.
• Every link: target in the new file and in the edited index resolves.
• The report renders with asciidoctor without warnings.
• The reproduction tables were produced by re-running scripts/time-model-input-probe.sh against the stock and patched QEMU binaries and a minimal QEMU-only form.