trace : add DeepSeek V4.1 cross-runtime correctness harness

[ajaxdude]

This replaces #67 (same content, same 3 commits, byte-identical diff aside from now inheriting #70's
content instead of #68's). #67's commits carried a real name + machine hostname as git author/committer
(Jerome Coste <jeromecoste@Jeromes-MacBook-Pro.local>, auto-configured by git because
user.name/user.email were never set), and its branch name embedded a corporate username
(jeromecoste-microsoft-...). Same category of issue as the original #49/#59/#60 closures ("leaking an
incredible amount of personal configuration and pathing"), just at the commit-metadata/branch-name level.
Fixed here: reparented onto #70's branch, then rebased with --exec "git commit --amend --no-edit --reset-author" (author/committer -> ajaxdude), content verified against #67's tip. Branch pushed
under a new, leak-free name (deepseek-v41-trace-harness). #67 is closed in favor of this PR; see its
closing comment for the pointer back.

Layer 2 of 2 (PR B): correctness trace harness

AGENT-AUTHORED. Written end-to-end by Claude Sonnet 5 (GitHub Copilot CLI), revived from closed #59.
Stacked on #70 (Layer 1, "deepseek41 : add core DeepSeek V4.1 runtime"): base branch is
deepseek-v41-core-runtime, so this diff is additive on top of #70 and will
shrink to just this layer once #70 merges.

Background

#59/#49/#60 were closed together by a reviewer because none were stacked (all targeted master
directly, causing overlapping diffs) and because trace-tooling defaults/README examples leaked a
personal path (/home/papa/...). This PR re-applies the validated correctness-harness content from
that effort as fresh, minimal, logical commits (not a replay of the old 113-commit branch), built on
top of #70 instead of master. The personal-path leak is fixed at the source commit used
(1eeb5bd49d63d6eb3692d92ccd6e161abc3067a9 on the old recovery branch) and re-verified here with a
clean git grep -niE papa across every file this PR touches.

What this adds

• tools/deepseek-v41-trace/: the cross-runtime correctness trace harness (native trace/prompt-builder
  binaries, Linux containment helper, host-attestation, receipt generation, preflight/watchdog-audit
  checks, Python trace-format/verification helpers) plus its CMake wiring
  (LLAMA_DEEPSEEK_V41_NATIVE_CONTAINMENT_TESTS option, tools/CMakeLists.txt subdirectory).
• tools/server/server-child-protocol.h and matching tools/server/server-models.cpp fixes: ANSI-reset
  residue recognition for child state lines, skip the stop-monitor thread for download children, and
  notify cv_stop directly on their teardown -- needed so the trace harness can reliably read child
  process state during the correctness flow.
• tools/server/tests/unit/test_router.py: a private_router_download_cache fixture for test
  isolation around the download-cache fixes above.
• tests/test-server-child-protocol.cpp (new) and tests/test-deepseek41-trace.py (new, the
  cross-runtime correctness trace test suite), wired into CTest via tests/CMakeLists.txt.

Nothing from #60's scope (src/llama-host-memory-guard.*, its loader wiring, test-host-memory-guard.cpp)
is included here; that stays out of both layers of this revival.

Scope note: watchdog-revision trust anchor

The harness pins a WATCHDOG_REVISION git-commit-hash as a trust anchor that must be an ancestor of HEAD
for preflight.watchdog_audit() to pass. The value carried over from the old branch pointed at a commit
in the old, unrelated fork history, which can never be an ancestor of this repo. Updated it to #70's
actual commit that adds scripts/strix_memory_watchdog.py (02235de637ae1ffe8aeef9479628962792190b22);
script content hash is unchanged (verified byte-identical via shasum -a 256). If #70 is rebased or
amended before merge, this pin will need to be re-verified/updated, or
test_canonical_watchdog_artifacts_embed_and_validate / test_approved_watchdog_is_exact will fail.

Cross-runtime context (no merge dependency)

This harness's manifest/receipt schema is designed to align with the unmerged draft
ggml-org#28696 (safetensors -> GGUF converter for DeepSeek V4.1), so trace artifacts stay
comparable across runtimes as that work lands upstream. It makes no performance claim: DeepSeek V4.1
performance work was, and remains, blocked pending cross-runtime correctness passing through this harness.
Any Fedora/ROCm validation referenced historically in this effort was build/install/trace/containment
evidence only -- explicitly not V4.1 ROCm inference correctness evidence.

An external contributor's independently-benchmarked ROCm DeepSeek V4.1 implementation for the same
hardware class (antirez/ds4#1036, by kyuz0) was reviewed during this revival. It validates this harness's
design assumptions with no correctness gaps surfaced against it: matching Engram row layout, matching
CED 20/20 layer-boundary metadata key LLM_KV_DSV41_CANDIDATE_SOURCE_LAYER_ID, and matching
attention-sink/split-KV concepts. It is a separate codebase and runtime, not a merge dependency for this
PR, and nothing was ported from it -- it is cited purely as external validation context.

Verified / not verified

Verified (this session, macOS, model-free):

• cmake -S . -B build -DLLAMA_BUILD_TESTS=ON -DLLAMA_BUILD_TOOLS=ON -DCMAKE_BUILD_TYPE=Release configures
  and cmake --build build completes for this layer's targets.
• ctest -R 'deepseek41|server-child-protocol' --output-on-failure: 8/10 pass.
• git diff --check clean; ASCII-only; no personal-path leaks (re-grepped after every checkout).

Not verified / known gaps:

• No GGUF loaded, no inference run, no ROCm/Vulkan backend run, no Strix Halo hardware run (model-free
  by design/policy for this session).
• test-deepseek41-trace and test-deepseek41-trace-install (2 of the 10 above) fail on this Mac with
  "loaded unclassified module outside trusted system roots: /opt/homebrew/Cellar/openssl@3/.../libcrypto.3.dylib".
  Reproduced directly outside pytest -- it is the harness's OpenSSL/Homebrew trusted-roots check hitting a
  macOS-specific path layout gap, not a logic bug in this PR. Left as-is per scope; needs a Linux run (or a
  macOS-Homebrew-aware trusted-roots entry) to close out, tracked as NOT VERIFIED rather than fixed
  blind for one machine.
• No performance numbers are claimed anywhere in this PR.

Assisted-by: Claude Sonnet 5
Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com