comgr: prove zero tensor masks through local control flow - #5

Summary

• prove that a tensor descriptor's low 16 bits are already zero on every reachable predecessor path and leave the code object byte-identical when the workaround is a semantic no-op
• build the tensor-local CFG fail-closed: reject unresolved/opaque transfers, calls while descriptor state is live, non-preserving definitions, and entry paths without a proven zero definition
• admit only exact audited reusable-PC set-PC sequences (including the signed two-arm form) and exact object-wide bounded-return target sets
• expose the object-wide bounded-return target map to the tensor CFG without weakening the existing closed-world control-flow audit

Soundness coverage

• unresolved set-PC alternate entry into the tensor
• direct entry and declared function entry into a reusable-PC sequence interior
• wrong set-PC pair, intervening pair definition, and out-of-function target
• alternate entry into the signed sequence's positive arm
• audited bounded return with an in-function target (positive) and an out-of-function target (negative)
• nonzero path seed, non-preserving low16 loop, and a call while descriptor state is live
• idempotent definition rewrite and byte-identical already-zero no-op

Validation

Validated commit e29247ce80a13fd74fa8081119662f131aee7cbb
(tree 279c5327e087f84d9e869a5285e51e407842c262) on exact parent
1f20ad62a422ca97a83d78e4983dee19fe7ba0be.

• unit suites: HotswapElf 31/31, HotswapMC 167/167, Profile 9/9, Raiser 6/6, Demangle 27/27, Logger 21/21
• Comgr tensor-mask lit: 20/20
• standalone reviewer-hole probes: non-preserving loop and live call both reject the already-zero proof, use the fallback, and pass llvm-readobj
• 084 representative: first pass byte-identical, second pass byte-identical, llvm-readobj PASS
• exact parent residual set (38 paths): S->F 0, F->S 12, F->F 22, S->S 4; all 12 new successes are byte-identical and pass llvm-readobj
• immutable full corpus: 2,685 total, 2,649 success, 36 failure, 0 timeout, 0 invalid output; all 2,649 successes pass llvm-readobj; source, tree, changed-source hashes, tool/library hashes, and output integrity PASS
• full parent-to-PR transitions: S->F 0, F->S 12

The full run's 36 failures consist of 22 residual parent failures (14 unique
basenames) plus 14 inherited gateway-exhaustion failures (7 unique hashes,
mirrored under kpack and objects). The latter 14 were rerun with verbose
logs on both exact 1f20 and exact e29247c: all fail on both revisions and
all 14 have identical first diagnostics (no safe short-branch gateway).
Thus the apparent bb63 S->F paths are parent failures, not regressions from
this PR.

Full artifact:
/home/harsh/hotswap-corpus-20260724-agent-sgpr-e29247c-full2685