fix(dogfood): batch 5 — the last three audit findings, and a producer that could fabricate its own verdict

[noahgift]

fix(dogfood): batch 5 — the last three audit findings, and a producer that could fabricate its own verdict

Closes out #2377 and #2375. Four branches, two of which an adversarial pass sent
back before they could merge.

#2377-3 — three lints documented a producer the binary did not have

attn-parity-lint, audio-inspect-lint and embed-viz-lint each name a
producer command in their help text. apr kernel parity, apr dataset audio-inspect and apr debug embed-viz did not exist, so the only documented
way to produce the observation they consume was unreachable: their gates had
never run on real data and could not. All three are implemented, wired into the
clap tree and the dispatch arm, with round-trip falsifiers — run the producer,
feed its output to the lint, assert exit 0 — plus the negative, that a corrupted
producer body makes the lint exit non-zero, so the round trip cannot pass
vacuously.

The first attempt shipped the defect this audit exists to eliminate.
Replacing the emitted metrics in kernel_parity.rs with the literals
max_abs_diff: 0.0, cosine_sim: 1.0 — a producer fabricating perfect parity —
left ALL 16 tests green, including the one named
the_parity_metrics_are_not_vacuous, which never went through run() at all:
it re-measured the values itself in the test body. Nothing asserted that the
EMITTED numbers were the MEASURED ones. Two falsifiers now bind emitted JSON to
measurement, and the 0.0/1.0 mutation turns them red.

And it emitted garbage on the format its own lint targets. locate_embedding
took shape[0] as vocab for every format. GGUF reports GGML ne order, so
token_embd.weight on Qwen3.5-0.8B-Q4_K_M is [1024, 248320] — the producer
wrote 1024 rows for a 248320-token vocabulary and embed-viz-lint exited 5 on
its own producer's output. The axis rule is now per-format and measured, not
assumed: reading the GGUF payload as [vocab][hidden] matches the same model's
SafeTensors row at cosine 0.999, transposed at 0.014. The tests missed it because
the only fixture was an APR file — the one layout where the axes coincide.

Note the trap the contract now documents: token_str is resolved by row index,
so it reads correctly no matter which axis produced the coordinates. No assertion
on token_str can detect this. The tests assert row count against the vocabulary
and coordinates against a hidden-length slice.

#2375 — every streamed chat reply was empty, and /v1/metrics measured nothing

Also remediated after review. A falsifier named
v1_metrics_model_name_is_derived_not_a_constant PASSED on a constant
("default"); the derived branch was executed by no test, and it only went red on
revert because the previous constant differed. A test comment and commit message
claimed 0.63.0-era provenance for a code path that did not exist in v0.63.0. And
the temperature fix special-cased only == 0.0, so negative, NaN and +inf still
reached apply_temperature and returned HTTP 500 — the same class as #2391,
where NaN <= 0.0 is false and a guard that looks like validation admits it.

#2310 — wasm32 could not compile

(seed * 6364136223846793005 + ...) in the SGD epoch shuffle: the literal does
not fit usize on a 32-bit target, so aprender-core failed to build for wasm32
entirely.

pmat complexity — the files that taxed every commit

The pre-commit hook rejected any commit TOUCHING validate.rs,
dispatch_analysis.rs, prometheus_classifier.rs or react_trace_classifier.rs;
three commits this week landed with --no-verify carrying before/after tables
proving they had not moved the metric.

One claim corrected rather than merged

The producer branch reported "PCA exit 124 @300S -> exit 0 @7s". Independent
re-verification measured the DEFAULT --projection pca on that model at exit
124, wall 300.33s, no CSV — with an unbounded rerun still going at 2198s. The 7s
was the RANDOM projection. Fixing the axes made PCA tractable, not fast: at fixed
hidden=1024 the cost is linear in ROWS at ~6.3ms each (5,000 rows 82.6s; 20,000
rows 176.9s), so a 248,320-token vocabulary does not finish in 300s.

The book now carries that scaling table, and FALSIFY-LINT-PRODUCER-008's scope
says explicitly that RUNTIME is discharged nowhere — every test in the contract
uses --projection random. Stated rather than gated on purpose: a falsifier for
a 26-30 minute run is a 26-30 minute CI test. An unstated performance claim in a
book chapter is what this audit exists to stop.

Closes #2377
Closes #2375
Closes #2310

Refs #2373

---

Verification

• cargo test -p apr-cli -p aprender-serve -p aprender-core --lib — 36,801 passed, 0 failed
  (7,064 + 14,099 + 15,638; these are the only crates this diff touches)
• CI's 18-command integration chain + all 9 guard scripts — 27/27, TOTAL_FAILS=0
• scripts/check_assertions_exclude.sh — 319 sites, delta 0
• cargo fmt --all -- --check — clean
• contract count 1771 matches the README claims row (FALSIFY-README-007 green)

A full cargo test --workspace --lib was started twice and killed externally
both times, at 48,161 and ~0 tests in with 0 failures in each. Rather than
report a number I did not see complete, the figures above are the targeted run
that did finish. CI runs the full workspace on this PR regardless.