dogfood pre-publish verdict depends on the machine: two declared gates read host model files #4981

Refs #4433

Moving the T-1 dogfood off the release workstation and into a clean-room runner job (the C8 row of #4433) turned up two declared gates whose verdict depends on the machine rather than the commit. I checked one clean-room runner host read-only on 2026-10-09.

1. tokenizer_parity has no declared model list. Its denominator is every *.gguf in ${APR_MODEL_DIR:-$HOME/models} (scripts/tokenizer_parity.sh:94).
   • The runner host's model dir holds tinyllama-1.1b-chat-v1.0.Q4_K_M.gguf, which has a SentencePiece vocabulary. apr reports it as "not a byte-level vocabulary", the script counts that as UNCOVERED (:135), and any UNCOVERED row makes it exit 1 (:173).
   • The same commit is GO on the release workstation, whose model dir has no such file.
   • It cuts the other way too: a model the workstation checks is simply not checked on a host that lacks it.
2. The MoE comparator test reads machine paths. dogfood_comparator_env_tests runs qwen3_moe_argmax_parity, which looks for the Qwen3-Coder-30B-A3B GGUF at three absolute paths (crates/aprender-serve/tests/qwen3_moe_argmax_parity.rs:78-82). Two of those paths can exist on only one machine.
   • None of the three exists on the runner host, so the test prints skipped —. The gate correctly counts that as FAIL (scripts/dogfood_comparator_env_tests.sh:57-59).
3. The pool selector spans several machines. [self-hosted, Linux, X64, clean-room] matches runners on three machines provisioned differently: on two the jobs run on the host, on one they run in a container. A dogfood job's verdict would then depend on where it was scheduled.

Not measured: float16_greedy_parity on a CPU without avx512_bf16. Its committed receipts all come from one machine.

Done when

• tokenizer_parity reads a committed list of models (name and sha256). A listed model that is absent is FAIL, never skipped. An unlisted file in the dir is ignored.
• The MoE comparator test finds its model through a declared model dir, filename and sha256, not through machine paths. An absent model stays FAIL, as it is now.
• The release dogfood job and the nightly dogfood producer pick one provisioned machine by label, and a pre-publish run there at a release commit reads GO before the C8 row's PR opens.

Neither change loosens a gate, because an absent input stays FAIL. Each is still a gate change and needs a non-author sign-off.