refactor(core): C++23 Wave 5 — cpu, ref, thread_locale (ADR-0735)

[lusoris]

Summary

• cpu.c → cpu.cpp: std::atomic<unsigned> for CPU-flag globals — eliminates potential init-time data-race; memory_order_relaxed on the hot vmaf_get_cpu_flags() read path.
• ref.c → ref.cpp: std::make_unique<VmafRef>() replaces malloc+memset+atomic_init; leak-safe error paths; vmaf_ref_close uses delete; extern "C" guards added to ref.h.
• thread_locale.c → thread_locale.cpp: VmafThreadLocaleState destructor encapsulates platform teardown (POSIX / Win32); vmaf_thread_locale_pop is a unique_ptr one-liner; std::array<char,256> on Windows.

Each file compiled as an isolated static_library with override_options: ['cpp_std=c++23'] (ADR-0708 pattern). Public C ABI preserved unchanged.

Test plan

# Build host-side CPU-only
cd core && meson setup ../build-wave5 -Denable_cuda=false -Denable_sycl=false -Denable_asm=true
ninja -C ../build-wave5
meson test -C ../build-wave5 --suite=fast
# Expected: 49/49 PASS

Checklist (ADR-0108 six deliverables)

• Research digest: no digest needed: bulk Wave 5 continues ADR-0708 playbook
• Decision matrix: docs/adr/0735-cpp23-wave5-bundle.md § Alternatives considered
• AGENTS.md invariant: core/AGENTS.md — C++23 migration surface table updated
• Reproducer: meson commands above
• Changelog fragment: changelog.d/changed/cpp23-wave5.md
• Rebase notes: docs/rebase-notes.md — ADR-0735 entry

Per-surface docs

no user-discoverable surface change — internal refactor

docs/state.md

no bug opened/closed/ruled-out — refactor only

ffmpeg-patches

no public C-API change — internal TUs only

🤖 Generated with Claude Code

[lusoris]

CRITICAL finding from adversarial review: ref.cpp vmaf_ref_init now allocates VmafRef via std::make_unique (operator new), but vmaf_ref_close uses delete. Any C caller that calls free(ref_ptr) directly on a VmafRef* (a pre-existing pattern from when the allocator was malloc) will corrupt the heap — free() on a operator new pointer is UB. This is a silent ABI contract change invisible from the ref.h signature. Fix: add a prominent comment to ref.h that vmaf_ref_close is the ONLY valid deallocator, and audit all C callers (picture_pool.c, framesync.c, etc.) for any direct free(VmafRef*) calls. See docs/research/cpp23-wave-adversarial-review-20260528.md finding #18.

[lusoris]

Fix for CRITICAL adversarial review finding in PR #78 pushed as 371a0f3. See PR #78 digest for context.