v2.5.2

Flash-Next v2.5.2: idle cards drop to P8 with the bounds guards on. Point release on Merlin engine v2.5.2 = the v2.5.1
engine plus one commit, the bounds-guard reader fix. Same checkpoint, serving shape (TP2 × PP2 + EP, MTP K=3), KV pool
and compiled ops as v2.5.1.

• Idle power. With GUARD=warn (the default) the guard reader used to copy its counters to the host every 50 ms
  forever, which holds an idle RTX 3090 in P2. It now parks once the engine drains, after a final read of every
  counter: four idle cards draw about 110 W in P8 instead of 446 W in P2 on the reference host.
• Every bounds check stays on. A hit from the last step is read and reported before the reader parks; while
  serving, detection is unchanged. VLLM_E2_GUARD_IDLE=0 brings back the always-polling reader.
• Speed unchanged. Single-stream decode and cold prefill read as v2.5.1's within run-to-run noise (cell medians
  within ±1.8 %).
• Shared with the Qwen3.8-27B releases: the same engine commit, applied from the same patch file.

Thanks to CoolShades for the idle-power report in issue #2 and for PR #3, which led to this fix.

Build: scripts/build-v2.5.sh with this release's bundle and the v2.2.0 release's build-artifacts tarball (v2.5.2 changes
no compiled source; the tarball is reused, pinned by sha256). Serve: scripts/serve-v2.5.sh. Patch notes:
CHANGELOG.md; measurements: benchmarks/2026-10-12/BENCH-CARD.md; reference: docs/reference.md.

Requirements: as v2.5.1 (Linux x86-64, glibc 2.34+, Python 3.13 with headers, an NVIDIA driver with CUDA 13.0 or newer,
four 24 GB Ampere cards, 96 GB host RAM qualified).

Assets:

file	sha256
v2.5.2-from-upstream-v0.30.0.bundle.gz (the source; upstream/PIN-v2.5 pins the uncompressed bundle, ab70e1a39768d4ae016f7f9f0ae99165c20c0e0136579f557084218cef8bd685)	b154901627a985ce5469d4aebc2a15dbd07bb2c3e5c38f9517bdde9ae55ee0e2
build-artifacts.list (the 23 build-product paths; also in the repository)	2befac68d349aea26e0b35f59f4d04eda6c652ae7037f48fab8920c33ab5e432
build-artifacts-sm86-py313-cu130-v2.2.0.tar.gz (reused from the v2.2.0 release)	cdca5ffcb3003d15e00896f0969134e16d7bfbe0a3c6dfe10698bec32573f592