fix(genai): isolate EPContext compile from og.Model load (#1087)

[DingmaomaoBJTU]

Problem

winml perf -m <bundle> --compile --runtime winml-genai --device npu can native-crash (0xC0000005 / 0xC0000374) at og.Model() load, before the first token — even when every stage is already compiled and cached.

Root cause: GenaiSession.load() runs the crash-prone EPContext compile orchestration (_prepare_compiled_bundle, which spawns and reaps per-stage QNN compile workers that native-fault during interpreter/driver teardown) and then loads og.Model in the same process. Orchestrating those crash-prone subprocesses leaves the orchestrating process's native accelerator state fragile, so the subsequent model load faults.

The proven workaround was to compile in one process (--compile) and then load _compiled/ in a fresh process (no --compile).

Fix

Run the compile orchestration in a throwaway spawned subprocess: it writes _compiled/ to disk and exits, keeping the parent process — the one that loads and runs og.Model — pristine. This mirrors the two-step workaround (the load process never runs the poison-prone orchestration) while keeping the in-process streaming/timed generation API intact for every GenaiSession consumer, with no cross-process result serialization.

The parent only spawns/reaps one clean orchestrator child (which exits 0); it never directly reaps the crashing per-stage QNN workers, so it stays clean for the model load. The child writing _compiled/ to disk is the durable hand-off — the queue only carries the resolved load-dir path as a fast-path signal.

• Add module-level _prepare_compiled_bundle_worker (spawn target): reconstructs a compile-only GenaiSession, runs _prepare_compiled_bundle, posts ("ok", <load_dir>) / ("error", <detail>).
• Add GenaiSession._prepare_compiled_bundle_isolated: spawns the worker, drains its single result, and on any child failure falls back to the on-disk _compiled/ bundle if present — never an in-process compile (which would reintroduce the poisoning), else the original bundle dir.
• load() routes the --compile path through the isolated variant; the override-only path (JSON rewrite + file mirror, no native accelerator work) stays in-process.
• Docs: winml perf --compile now runs compile + generation end-to-end in one command; the manual two-step is kept as an optional way to reuse a prebuilt _compiled/ bundle.

Verification

• tests/unit/session/test_genai_session.py — 142 pass (12 new: worker posts ok/error, isolated wrapper returns path + drains-on-exit + fallbacks, load() routing).
• tests/unit/commands/test_perf_genai.py — 54 pass (the only compile=True consumer, unchanged by design).
• ruff check clean on both changed Python files.

Note: the actual native-crash fix is validated by design (it mirrors the proven cross-process workaround) plus unit tests with mocked subprocess machinery — I don't have NPU hardware to reproduce end-to-end.

Fixes #1087.