feat(hardware): establish named device mesh ownership

[fivetide]

Summary

Establish G1's topology authority for multi-device execution. The sole multi-device owner moves from hipfire-runtime::multi_gpu into the new hipfire-hardware leaf, while a pure, typed DeviceMesh defines named PP/TP/EP placement, mesh-generation identity, stage boundaries, and collective groups.

This is the root changeset for the topology work tracked by #666. It supplies the owner and topology contracts that later admission, manifest/store, and MoE work can consume without introducing another ownership or rank-policy implementation.

What changed

• Added the hipfire-hardware workspace crate and moved crates/hipfire-runtime/src/multi_gpu.rs to crates/hipfire-hardware/src/lib.rs (an 89% rename). Gpus remains the single owner of resolved device IDs, VRAM/architecture preflight, peer access, boundary copies, RCCL/host/peer reductions, and peer-reduction scratch leases. The runtime module and compatibility re-export were removed; the ownership integration test asserts that the legacy owner path is absent.
• Added the pure DeviceMesh module. DimKind::{Pp, Tp, Ep} names the parallelism axes; rectangular shapes use row-major coordinates with checked cardinality, group_along derives axis subgroups, stage_for_layer and stage_devices describe PP bands, and band_xfer_after emits the PP boundary hint. CollectiveHint distinguishes axis all-reduces from pipeline band transfers.
• Added MeshEpoch as identity for an admitted mesh generation. New single/rect meshes receive fresh epochs; clone and squeezed preserve the epoch, so shape-equivalent meshes are not silently treated as the same generation.
• Kept topology independent of GPU handles, loading, allocation, and carrier policy. RuntimeConfig::device_resolve_opts lowers the already-resolved logical visibility IDs and hardware knobs into the leaf; hardware consumes those values instead of rereading process environment. init_uniform, init_layers, init_tp, and single now use that explicit construction input.
• Made collective membership explicit at the EP seam. run_layer_program_ep and its reduction helpers receive an ordered group; RCCL all_reduce_sum_f32 validates the full ordered owner group, while all_reduce_sum_f32_peer validates unique global device IDs and is the genuine subgroup-capable path for composed TP×EP layouts. Current architecture callers pass the ordered full-device group and all affected DeepSeek4, MiniMax, Qwen35, generator, loader, runtime, and example call sites now use hipfire_hardware::Gpus.
• Added mesh unit coverage and hardware-leaf ownership coverage for composed coordinates, PP boundary hints, epoch preservation, overflow rejection, owner exposure, and removal of the runtime owner path.

Goals

Short term

Make hipfire-hardware the one topology/ownership authority now: resolve the visible logical devices once, expose named PP/TP/EP placement primitives, and require collective callers to state their participating group explicitly. Preserve the existing PP, TP, and EP routes while removing the duplicate runtime owner and its compatibility surface.

Long term

Provide a composable device-mesh substrate for the next admission and execution layers. #674 admission, #675 manifest/store, and #677 MoE execution should be able to consume typed coordinates, axis subgroups, stage transfers, and mesh epochs rather than reimplementing device ownership, rank arithmetic, or environment policy in each feature.

Benefits

• There is one multi-device Gpus owner and one resolved hardware-policy boundary, so runtime, loader, architecture, and generated callers cannot drift onto parallel ownership implementations.
• PP×TP×EP placement is represented as named axes and validated coordinates/groups instead of scattered positional rank math. The same substrate can derive a TP or EP subgroup from a composed mesh and retain identity across shape-preserving operations.
• Collective routing is explicit at the API boundary: full-owner RCCL reductions are distinct from direct peer reductions that can serve real subgroups, making the current limitation and the future ncclCommSplit seam visible rather than implicit.
• Later admission, manifest, and MoE work can be typed against topology data and mesh generations, reducing policy duplication and making ownership/placement errors fail at the hardware API boundary.

Dependency and landing order

• Root changeset: no device-mesh PR dependency. This PR is the root for G2 admission (feat(loader): centralize source-aware parallel admission #674), G3 manifest/store (feat(runtime): add device-mesh weight manifest and store pilot #675), and G5 MoE execution (feat(dispatch): seal collective-aware MoE step execution #677); those changes should land after this owner/topology contract.
• G4 lifecycle (fix(runtime): consolidate generation lifecycle ownership #676) is independent and does not depend on this topology cutover.

Verification

• Changed Rust files pass scoped rustfmt.
• cargo build passes on the final rebased head.
• cargo clippy -p hipfire-hardware --all-targets --no-deps -- -D warnings passes for the changed package; dependency warnings remain pre-existing.
• cargo test passes: 3,454 passed, 12 ignored.
• Physical multi-device route validation was not run in this changeset.
• python3 -m tools.change_gate run --base beta was not run.
• No Architecture trait surface change.

Nonclaims / follow-up

• This changeset establishes the topology and ownership substrate; it does not implement admission (feat(loader): centralize source-aware parallel admission #674), manifest/store (feat(runtime): add device-mesh weight manifest and store pilot #675), MoE execution (feat(dispatch): seal collective-aware MoE step execution #677), or lifecycle work (fix(runtime): consolidate generation lifecycle ownership #676).
• The mesh module is descriptive and GPU-independent; it does not itself admit devices or allocate/launch work.
• RCCL subgroup communicator splitting is not implemented here (all_reduce_sum_f32 remains full-group only); use the explicit peer subgroup API until the later communicator-split work lands.

[Kaden-Schutt]

Note for anyone landing here: this PR shows MERGED, but its content was backed out of master the same evening in a0fca0d6d after the G2 admission layer refused every Qwen3.5-family registry model on hardware. The merged state is preserved at tag archive/device-mesh-merged-20260901 (541b33c33). Full account, both reproductions, and the re-land path: #666 (comment)