feat(adapters): add GPU correctness evidence

[morluto]

Description

Flameox can preserve trial verdicts and benchmark samples, but it could not retain bounded per-case numerical evidence for GPU kernel validation or collect NVIDIA Compute Sanitizer findings as first-class evidence.

This PR adds those two correctness layers while keeping the upstream tools authoritative.

Relates to #131.
Relates to #135.

Approach

• Define the strict flameox.kernel-validation.v1 contract, publish its generated JSON Schema, and extract case/output identities and declared metrics into additive Parquet tables.
• Add CLI and MCP extraction with typed structured results, progress, schema resources, and links to authoritative artifacts.
• Wrap the official compute-sanitizer CLI with closed options, fixed XML output, bounded isolated parsing, and preservation of stdout, stderr, reports, and failed attempts.
• Bind suppression-file bytes into capture identity. Execution reopens without following links, verifies the planned digest, stages a read-only copy, and rejects post-plan mutation before launching the tool.
• Keep native JSON/XML authoritative; normalized evidence remains rebuildable.

Suggested review order:

1. src/flameox/adapters/kernel_validation.py and the published schema
2. src/flameox/adapters/compute_sanitizer.py and its worker
3. capture planning/execution and evidence publication
4. CLI/MCP surfaces, tests, and adapter compatibility notes

Commands run

# Focused kernel-validation, Compute Sanitizer, and MCP tests: 42 passed
uv run python tools/test.py optional-compute-sanitizer
# 2 passed on the local NVIDIA host

uv run ruff check src tests tools
uv run ruff format --check src tests tools
uv run mypy src tests tools
uv run lint-imports
uv run python tools/test.py ownership
uv run python tools/test.py collection

The collection receipt covers 923 node IDs across 84 files. Both import-boundary contracts pass, and generated-schema regeneration leaves no diff.

Compatibility

The evidence schema advances additively from 1.8 to 1.9. Historical generations receive typed empty validation views and are not rewritten.

Compute Sanitizer capture requires the official NVIDIA executable and a compatible CUDA GPU. Deterministic fixtures cover clean, malformed, truncated, unknown, and bounded-report behavior; the local provider lane also passed clean and intentional out-of-bounds kernels. GitHub-hosted CI runs the fixture and simulated-process coverage and does not schedule a GPU lane that could pass only by skipping.

[morluto]

@codex

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb0a5adff8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".