Fix unsigned underflow in available physical page calculation

[cmssmc00]

Partially addresses #371.

Summary:

• Avoid unsigned underflow when subtracting GPU utilization headroom from available physical memory.
• Return 0 usable physical memory when available memory is below the configured headroom.
• Prevent the prealloc path from seeing an artificially huge available-page count under memory pressure.

Tests:

• git diff --check

[shipiyouniao]

The saturating subtraction looks correct. Could we add a regression test for the boundary that caused the unsigned underflow?

It would be useful to cover available > headroom, available == headroom, and available < headroom, with the latter two producing zero usable pages. The PR currently records only git diff --check, so the exact size_t boundary can regress without CI noticing. If the GPU query makes this difficult to test directly, extracting the saturating subtraction into a small helper would allow a GPU-free unit test.