Refactor: host-build trb runtime arena (a2a3 only)

[poursoul]

Summary

Two-commit refactor on the trb runtime, both authored by @poursoul. The PR
bundles them because the second is built on top of the first; squash-merge
gives a single coherent landing.

1. fe5d662 — Refactor: defer slot_state payload/task bind to orch::prepare_task

   • Lifts the O(task_window_size) slot bind loop out of RingSchedState::init
     into per-submit prepare_task, making startup independent of window size.
   • Mirrored across both a2a3 and a5 trb runtimes (touches
     pto_orchestrator.cpp, pto_runtime2_types.h, pto_scheduler.cpp on
     each arch).

2. d33daa5 — Refactor: host-build trb runtime arena, AICPU does only wire + SM reset ⚠ a2a3 only

   • Moves the entire trb runtime arena layout + data init from AICPU's
     runtime_create_from_sm onto the host. AICPU boot becomes a cheap
     arena-internal pointer wire pass + the SM reset that can't run off-device.
   • Pooled prebuilt image lives in the same DeviceRunner static_arena as
     gm_heap and SM (one rtMalloc per worker), reused across all subsequent
     runs via a single rtMemcpy.
   • Scope is intentionally a2a3-only: src/a5/** is untouched in this
     commit (a5 keeps its current AICPU-side runtime_create_from_sm path).
     The plan is to mirror to a5 in a follow-up PR after this lands and
     stabilizes on a2a3 hardware/sim.

Mechanism (commit 2 / d33daa5)

• DeviceArena::attach() wraps an externally-owned buffer; re-attach is
  permitted so each AICPU boot can reuse the pooled image.
• runtime_create_from_sm split into reserve_layout / init_data_from_layout
  / wire_arena_pointers / finalize_after_wire; orchestrator / scheduler /
  tensor_map / ready_queue / spsc gain matching data+wire pairs.
  finalize_after_wire stays AICPU-only since it binds s_runtime_ops.
• pto2_sm_layout helper computes SM device-side field addresses by pure
  offset arithmetic so host init never dereferences SM.
• Per-slot SM-side reset moved from RingSchedState::init into
  PTO2SharedMemoryHandle::init_header_per_ring so the AICPU still owns it.
• New file runtime/shared/pto_runtime2_init.cpp holds the host-able pieces
  lifted out of pto_runtime2.cpp / pto_orchestrator.cpp /
  pto_scheduler.cpp. AICPU-only ops table / submit_task / dispatch stay put.
• DeviceRunner::setup_static_arena now takes a third runtime_arena_size
  region (hbg passes 0 — hbg has no prebuilt runtime arena).

Why a5 is deliberately not touched in this PR

The host-build refactor is a non-trivial reshape of the runtime arena init
path. Keeping a5 on the old AICPU-side path until a2a3 has time on real
hardware lets us validate the new contract (layout/init/wire/finalize phases,
pooled image lifecycle, SM-reset boundary) without making a5 a moving target.
Once stable, the a5 mirror is a mechanical follow-up.

Test plan

• cpput: 25/25 pass — ready_queue / spsc_queue / scheduler_state /
  task_state / wiring / tensormap UTs migrated to the data+wire API.
  task_allocator.init grew an optional initial_local_task_id (default
  0) so the near-INT32_MAX corner case is still exercised without an SM
  dereference.
• a2a3sim trb: standalone (dynamic_register variants, L3
  group/dependency) + L2 tensormap_and_ringbuffer 29 tests all pass.
• a2a3sim host_build_graph: 9/9 pass — verifies the shared HostApi
  changes (3-arg setup_static_arena, new acquire_pooled_runtime_arena
  field) don't break hbg.
• a2a3 hardware: tests/st/.../paged_attention_unroll passes on
  device 9 (--build, pto-isa commit pinned to CI).

Post-review hardening (commit 75f2562)

Address feedback after two independent review passes:

• pto2_sm_layout::ring_task_descriptors_addr: now takes a per-ring
  task_window_sizes[] array (mirroring the SM API) instead of a single
  uniform value; adds a ring_id range assert. Structurally prevents the
  host-built image from silently disagreeing with the SM layout if anyone
  later introduces per-ring window sizes.
• DeviceRunner::acquire_pooled_runtime_arena (onboard + sim): now
  returns nullptr when runtime_arena_region_off_ == SIZE_MAX so a stray
  hbg-path call cannot resolve to base + SIZE_MAX.
• DeviceArena::attach(): documentation rewritten to match real
  behavior (region table is not repopulated; reserve() cannot replay;
  region_size() returns 0); the pre-alignment / non-null / power-of-two
  checks now std::abort() unconditionally instead of relying on
  assert() (which is stripped in release builds).
• PTO2TensorMap::orch: dead back-pointer field removed (a2a3 never
  dereferences it); wire_arena_pointers loses its parent_orch
  parameter; forward declaration of PTO2OrchestratorState removed.
• PTO2Runtime::prebuilt_arena_base: dead mirror field removed. The
  host Runtime::prebuilt_arena_base_ is the real source of truth (AICPU
  reads it to locate the pooled buffer before it can dereference the
  image); the image still carries prebuilt_layout, which is consumed.
• PTO2SchedulerState::init_data_from_layout / RingSchedState:: init_data_from_layout: the unused task_window_size /
  dep_pool_capacity parameters are dropped (scheduler only needs SM base
  • ring index, both window-size-independent). All 4 cpput callsites
    updated.
• PTO2RingFlowControl::init(): comment added pointing back at
  PTO2TaskAllocator::init's initial_local_task_id default, so future
  changes to fc initial value / boot ordering are flagged in the same
  edit.

Test plan (post-hardening)

• cpput: 25/25 pass.
• a2a3sim trb: dummy_task + dynamic_register + L2 trb suite
  pass with --build (forces host + AICPU recompile).

[gemini-code-assist]

Code Review

This pull request implements a prebuilt-arena fast path for the PTO2 runtime, allowing the host to pre-compute the runtime arena image and upload it to the device. This optimization reduces AICPU boot time by replacing full initialization with a simple attachment and pointer "wiring" phase. Key changes include refactoring the initialization logic for the runtime, orchestrator, and scheduler into separate data-population and pointer-wiring stages, extending the DeviceRunner to manage a pooled runtime arena, and adding an attach method to DeviceArena for externally-owned buffers. Review feedback correctly identified potential undefined behavior in the new acquire_pooled_runtime_arena methods when the arena is not provisioned, suggesting defensive checks against SIZE_MAX offsets.