nnue_train: record embedded trainer build provenance

[SH11235]

Launching a trainer executable from another repository could record that repository's commit in the training experiment. Both training loggers now use the existing Cargo build identity capture. The compatible top-level commit is a full trainer revision (with a dirty suffix); optional params.trainer_build records source cleanliness, compiled backend, compiler and Cargo settings. params.trainer_backend separately records the backend selected for the run.

The build-info command exposes the embedded metadata without initializing CUDA. Build-script tracking covers worktree HEAD/index, common refs and packed refs, and the identity source files. Source archives nested in unrelated repositories and failed Git status queries are treated as unknown. Rescore retains its short commit fingerprint format and dirty/unknown nonce policy.

Validation:

• cargo fmt --all -- --check: passed.
• cargo clippy --workspace --all-targets -- -D warnings: passed (native default, Windows).
• cargo test --workspace --release: passed (native default).
• cargo test -p nnue-trainer --no-default-features: 109 unit tests and 2 integration tests passed.
• cargo clippy -p nnue-trainer --all-targets --no-default-features -- -D warnings: passed.
• Native rescore fingerprint and end-to-end tests: passed.
• Cargo fixture tests cover worktree commit/ref updates, packed refs, detached HEAD, staged dirty/clean changes, and unknown archive builds. The same executable reports identical identity from the trainer tree, an unrelated repository and outside Git.
• nnue-lab's current upload schema was checked: commit remains an optional string and params preserves unknown keys.

Full scripts/local-ci.sh was attempted. Its oxide-parity compile check fails in the existing pinned cuda-core dependency on Windows with i32/u32 CUDA enum binding mismatches. Oxide kernel generation/parity/equivalence gates therefore remain unverified. This is not reported as a full local-ci PASS.

The provenance document explains Cargo regeneration, stale dirty detection for untracked/unstaged changes, and the limits of source/compiler identity versus executable, dynamic library and external kernel hashes. No checkpoint, data-cursor, QAT or precision changes are included. Concurrent training changes should preserve the provenance fields in both experiment parameter builders.

Independent local reviews: Codex APPROVE and Claude APPROVE. Local commit: 1827fb4.

The owner approved using the successful native validation as the push gate for this PR; the oxide limitations above remain explicit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T05:32:10.663219Z	1827fb4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.