Make embedding calibration GPU-only and measure true idle correctly

[TheGreenCedar]

Context

CodeStory supports GPU embeddings only. This PR makes protected Apple Silicon Metal the sole required constant-calibration cell, keeps Linux Vulkan optional and nonblocking, separates runtime-constant freezing from frozen-candidate qualification, and closes the true-idle measurement boundary needed for 0.16.3.

Current frozen head: c72c87a963b81c626530958078b9f54f8f47efc5
Current frozen tree: af59f79662a481200f64b8f3aab6734108548380
Calibration source head: 681ca99098b86006e7dc1f51c27158c757ac05c9
Calibration source tree: 1a5494c9b82bcddc030438452285154e9d5b3e2b
Integrated dev base: 4cf5ab94c34b895db41fbd36baa7e276b1f4fde8

The generated constant set is the sole source change after calibration. This exact head is the frozen 0.16.3 candidate.

What changed

• Removes CPU from calibration and release-proof policy. backend: cpu, cpu_explicit, and CODESTORY_EMBED_ALLOW_CPU=1 fail policy.
• Makes protected macOS Metal the sole required calibration cell. Optional Linux Vulkan evidence cannot block assembly and never falls back to CPU.
• Runs constant-only calibration as three fresh server generations with one sample per metric, one archive unpack, one project setup, and one shared build/package invocation.
• Keeps lifecycle and fault scenarios, true-idle qualification, memory measurement, retrieval quality, and accelerator qualification out of calibration and in once-per-candidate qualification.
• Defines true_idle_exit from the completed product operation to confirmed engine-and-server absence, bounded by the fixed 60-second timeout plus 2.5 seconds of observation grace.
• Builds one exact Windows release graph and packages those exact binaries. Source-only path and native-staging contracts run in the parallel source lane.
• Caches model material by model SHA and candidate archives by exact source commit, target, and archive SHA-256. Every hit rechecks provenance, size, and digest; cross-SHA reuse fails.
• Keeps optional retrieval-quality evidence isolated, unclaimed, and nonblocking.
• Collects calibration before the sole broad source proof. The generated constant-only frozen head receives that one proof, and qualification still requires it at the exact frozen head.

Exact-head acceptance

The current frozen head is clean, pushed, and independently accepted. Evidence:

• workflow policy: 1,186 passed;
• release claim graph: 39 passed;
• packaged per-user embedding proof self-test: passed;
• release version validation: passed for 0.16.3;
• generated constant-set SHA-256: 02a452a8862f406307ee1409a0d73f1456a37e501342aa42f8a4755994989f9d;
• the generated constant set is the only path changed from calibration source to frozen head;
• calibration-release lineage validation passed;
• calibration assembly accepted the unfrozen/null baseline and rejected mutations restoring status: frozen or a non-null freeze_record.
• route/identity/lineage hostile matrix: 47/47 passed;
• claim-graph hostile mutation: passed.

Calibration run 30562970311 passed on the exact calibration source:

• dispatch to finish: 3m17s;
• protected Metal job: 2m39s;
• build/package: 60.056s;
• archive authentication/unpack: 2.357s;
• project/request setup: 1.076ms;
• three fresh-generation measurements: 68.674s;
• retained-evidence end to end: 71.034s;
• authenticated bundle: embedding-calibration-bundle-681ca99098b86006e7dc1f51c27158c757ac05c9;
• artifact digest: sha256:90225158d5426e8e1116ad7455f0daf3167f069e3d462fbd5206c75827fcc037;
• deterministic local reassembly reproduced the bundle and generated constant bytes exactly.

The earlier source proof on 69a82a61 is superseded and is not release evidence. The one broad source proof belongs on the current frozen head.

Freeze handoff

• Final intended source head: c72c87a963b81c626530958078b9f54f8f47efc5
• Known future source changes: none in the 0.16.3 lane
• Proof-triggering action: exactly one broad source proof on the frozen head, then frozen-candidate qualification
• Reusable evidence: calibration run 30562970311, generated-constant lineage, focused policy/claim/package checks, and hostile-mutation acceptance
• Invalidated evidence: source proof 30559706259 and calibration attempt 30560853444 on superseded head 69a82a61
• Currently running workflows: none
• Next permitted mutation: none; any source or workflow change revokes this candidate

PR #1581 and PR #1622 are active parallel lanes. Neither gates the 0.16.3 release.

Closes #1558

[TheGreenCedar]

Exact-source proof is green at a73c25c266c82ff9fabf466a4cab919f345b278f (run 30454756899). Fresh calibration run 30456979543 is active against this exact PR head with no reused evidence.

https://github.com/TheGreenCedar/CodeStory/actions/runs/30456979543

[TheGreenCedar]

Fresh calibration run 30456979543 failed before assembly: the first Metal run reported successful encode counter did not advance across two-host retrieval. Failure evidence was retained, and the still-building Linux cell was cancelled because the run could no longer assemble a six-run bundle.

No rerun is planned until the exact cause is fixed. Issue #1601 is now the parallel release-blocking CI repair required before another expensive source gate.

[TheGreenCedar]

Release freeze record

• Frozen pre-calibration source head: 69a82a61a402127dfcc217049d20938a245c5256; tree 846fc986db7ce8f5f1b7f1a066a4bcfacc551535.
• Final intended release source: that exact source tree plus one generated change to crates/codestory-llama-sys/per-user-embedding-server-constant-set.json; its commit does not exist yet.
• Known future source/workflow changes before 0.16.3: none beyond that generated constant set. Enforce an executable release freeze barrier #1622 is explicitly post-release and excluded.
• Proof-triggering action: one manual exact-head source-proof.yml dispatch after this freeze record; no label-triggered or support-PR proof.
• Reusable evidence: exact-head focused policy/claim/actionlint suites, independent hostile mutation acceptance, and the 15-second real-Windows target feature probe.
• Invalidated evidence: source proof 30551275509, calibration 30550654213, and qualification 30552009354 belong to superseded head e980b8205499545a61d3caa0c9937b2cf54cab48 and will not be reused.
• Currently running workflows: none; duplicate draft checks were cancelled.
• Next permitted mutation: none until source proof and calibration complete; afterward only the generated constant-set file may change before qualification.

Independent exact-head acceptance rejected the full CPU, calibration-shape, Windows package-feature, duplicate-build, debug/release, observation-source, and stale/cross-SHA archive mutation matrix.