_set_page_writable / MakePTWritable derived table pointers with
entry & ~0xFFF, which keeps reserved bits 52..62 and NX. An invalid
entry (P=1, PS=0, reserved bits set) produced 0xfffffffffffff000 and
a boot-time #PF in _set_page_writable.
Add _table_phys: keep address bits 12..51 and require reserved bits
52..62 to be zero. Use it at every non-leaf level in both walkers.