feat: detect unused constructor projection scratch (PS6140)

[jxsl13]

Summary

• Add PS6140, an opt-in advisory for constructor-owned projection scratch whose complete loaded public uses are absent or terminate at source-proved unused concrete parameters.
• Bind the actual public constructor, model geometry, backend allocation callback, immutable projection/class selection, retained ownership, error cleanup and release identity. Unknown dispatch, observers, mutation and reachable fallback use reject the candidate.
• Report exact allocation sites, selected constructor/backend combinations, symbolic requested bytes and explicitly illustrative profile ranking. Native count units, ownership and completion remain separately reviewed assumptions; this rule offers no automatic edit.

Evidence and coverage

• Retain full original before/after owner sources and replay the selected Metal/Darwin and CUDA/Linux/Windows partitions, including actual public/helper uses and the complete CUDA constructor-class matrix.
• Preserve required quantized, post-norm, sandwich and MoE scratch paths. Conventional analyzer fixtures must recover the original pinned decoder byte-for-byte after removing only expectation comments.
• Add parallel adversarial tests for constructor/callback identity, dispatch, immutable flags, escapes, retention dominance, failure cleanup, premature release, provider selection, configuration and reporting.
• Expose the retained-list source check through explicit constructor, factory/error, storage and public-context receipts. Preserve the existing PS6140 wrapper and keep list isolation separate from the complete lifetime conjunction; 17 authentic parallel controls cover input identity and required allocation participation.
• Include disabled-by-default example configuration and generated documentation. Owner runtime measurements are attributed, not presented as executions performed by these portable source fixtures.

Local validation

• All TestPS6140 tests pass with and without the race detector, including the genuine Metal and CUDA constructor/backend matrices and the shared retained-list controls.
• Independent in-depth feature, integration and final shared-helper reviews passed; the final helper review independently replayed all 17 authentic input controls.
• Normal commit hooks passed formatting, vet, build, all 2,122 discovered ordinary tests across 46 jobs, and the all-level self-scan.
• Normal pre-push hooks passed the full 46-job race suite, staticcheck with its matching Go toolchain, documentation freshness (432 checks), plugin build, all benchmarks at one iteration, and the all-level self-scan. The branch was pushed normally without bypasses.
• All 14 PR CI gates passed on the final head; CI on the exact merged default-branch commit remains required before issue closure.

Related work: issue 890. Issue status will be updated separately after merge and successful CI on the exact default-branch commit.

Follow-up CI runtime repair

• The first PR run passed 12 of 14 gates. Both Windows external-shard-1 jobs exhausted the outer 20-minute budget plus its existing five-second grace in the same checks group; the prior main Windows stable group already needed 1045.470 seconds.
• The identical 144-name group passed locally with Go 1.26, race detection, one CPU and -parallel=1 in 612.179 seconds. Its PS6131 campaign took 375.34 seconds and the twenty CUDA source-class cases added about 119 seconds.
• CI now selects at most 100 names per inner job, separating those workloads into groups 4 and 7. CLI/local-hook default 150, external hashing, workers, CPU shares, race detection, timeouts, tests and assertions remain unchanged. Both Windows shard-1 jobs passed the fresh run. The Windows stable checks groups 4/9 and 7/9 completed in 17m52.521s and 7m37.557s, respectively, within the unchanged per-process deadline; these are new group timings, not a same-workload speedup claim.
• Add job start/finish timing, verbose captured test progress and preservation of both the process failure and actual deadline/cancellation error. Cancellation is never retried; the narrowly recognized Windows runtime-crash classifier is unchanged.
• Independent final review cleared the complete seven-file repair. Go 1.26 scoped race, Go 1.27 scoped ordinary/vet and matching-toolchain staticcheck pass. Normal commit hooks also passed all 2,126 ordinary tests across 46 jobs, formatting, vet, build and self-scan.
• Normal follow-up pre-push gates passed the full 46-job race suite, matching-toolchain staticcheck, documentation freshness (432 checks), plugin build, every benchmark at one iteration, and all-level self-scan. Commit c6b89193f8e8c0c4e95cd2ba376725f093a52ff8 was pushed without bypasses.
• Fresh PR CI run 34780485368 passed all 14 gates on final head c6b89193f8e8c0c4e95cd2ba376725f093a52ff8. Its actual tested merge checkout was f62027daf3b000c6ad36ad73de8bfb2a7536807d, with parents b38ccb035a955915850a0e7f0bb99c091d64c0be and the final head. No unresolved review threads, review comments, or reviews were present at the final merge check. CI on the exact merged default-branch commit still gates issue closure.