refactor(gemma4): one forward path carries the numeric gates

[FeathBow]

Description

Closes #1014

The serving slices already retired the probe forward: the HF fixture gates drive the serving path teacher forced, with the same fixtures, tolerances and distributional floors. What remained of the old arrangement goes here. An incremental-versus-recompute gate answers for the one path's self-consistency where the probe comparison used to: every prompt position's logits through the decode arena match a whole-prompt recompute, and four decode steps fed the recompute's own picks match it too. The release-freezing test switch retires with the eviction gate it served — window_left masks out-of-window keys in-kernel, the waypoint gates cross the window against HF with the resident-page arithmetic asserted, and both arms of the new gate release their fronts as production does.

Test Env

Single GPU (sm_89, 48 GiB, x86_64)

Verification

• cargo fmt --all -- --check and git diff --check against main pass; the Gemma 4 release server builds; all-target Gemma Clippy passes with -D warnings; release lib tests pass.
• incremental_serving_matches_recompute passes 1/1 through the runner (whose membership check owns the manifest swap), on the golden fixture's short prompt the 2.0 ceiling was calibrated on: per-position max |dlogit| runs 0 to 0.79 against the 2.0 ceiling, with one near-tie top-1 flip admitted under the rule that both rows must rank the two candidates within the ceiling of each other; the four decode steps stay under it too. The 12B waypoint and greedy HF gates pass unchanged with the same fixtures and tolerances.
• The 26B checkpoint answers four greedy public /v1/completions requests (31-, 35-, 33- and 1421-token prompts, 64 forced tokens) with bytes identical to main's binary, md5 219de1e3c09c (everything removed was #[cfg(test)]).

[FeathBow]

The strict gate has its exact-head runner output. At the rebased head the reworked gate already ran with the strict assert and passed under the default bf16 profile: thirteen compared rows, zero argmax flips, per-position max |dlogit| 0 to 1.5 against the 2.0 ceiling. Under PEGAINFER_GATE_STORAGE=fp8 the same gate is red by design — the e4m3 pool's first divergent decision lands at position 2 and the strict assert stops it — which is the color that profile exists to show, beside its red agreement and waypoint gates. The earlier "one admitted near-tie flip" line came from a calibration on the pre-rebase base and does not reproduce on this one, which is exactly what let the contract tighten to strict with no separate margin constant.

The body and Issue text move with it: the short trajectory itself never crosses the window and says so, the crossing stays pinned by the waypoint, mixed-window, overlap and ragged gates, the no-coverage claim contracts to what the gate uniquely adds (full-vocabulary drift at every position of the nine-token prompt plus four non-cascading continuation steps), and the near-tie description is gone.

[sysuTobo]

A rule this PR introduced cannot hold, and it has now been caught: compare_row requires an identical argmax between two arms whose raw-logit drift the same callers bound by a calibrated ceiling — 2.0 in incremental_serving_matches_recompute, and neutral_scale (the function right above it) measures that same difference at 0.31..5.75 on the same rows. On a clean L20 that gate fails deterministically at the golden's short prompt:

prefill pos 2 ours:   top5 [(594, 13.6875), (497, 13.625 ), (236747, 13.5625), 236745, 575]
prefill pos 2 theirs: top5 [(497, 13.875 ), (594, 13.6875), (236747, 13.6875), 236745, 575]

The same five ids and the same tail; the top two 0.0625 apart on one side, 0.1875 on the other, the rows agreeing to 0.3125 elsewhere — reduction-order drift across a near tie, not a moved distribution. Green on boxes where that pair happens to sit wider apart, so the rule fails by environment, not by behaviour.

The other gates this PR touched have since moved to the near-tie form (lane_gates_logprobs.rs:67, via #1132 — "a flipped argmax must stay a near tie: each pick inside the other side's top-k"). #1136 applies that same rule to compare_row: a flipped pick must be a near tie, a pick outside the other row's top-k still fails, and both rows are printed when it happens. With it the gate passes end to end (9 positions, max |dlogit| 1.21875 against its 2.0 ceiling). It surfaced while running #1133's review on this box, which is where the report is.