feat(cosim): make the v2.4.2 acceptance gate executable, and it found a defect - #435

… a defect

The plan states v2.4.2's gate as prose: "hash-checkpoint agrees with full
capture". Checkpoints are an APPROXIMATION of "where do these two runs first
differ", traded for four orders of magnitude of disk, and the entire scheme is
worthless if the approximation can disagree with the answer. So the answer is
now computed directly by first_full_capture_difference, and the contract the
approximation must honour is localisation_is_consistent -- a function, not a
sentence in a plan document.

The contract is narrow deliberately, because a looser reading of it is
satisfiable by a broken implementation:

  identical streams          -> must report Identical. Anything else is a FALSE
                                POSITIVE, and a gate that cries wolf gets
                                switched off.
  a real difference at k     -> must NOT report Identical. That FALSE NEGATIVE
                                is the failure that matters: it passes a wrong
                                DUT.
  ... reported as Diverged   -> the named window must CONTAIN k.
  a real difference at k     -> Inconclusive is an honest "I could not answer".
  identical streams          -> Inconclusive is not.

The third line is the one worth the effort, and it is the one a weaker gate
omits. A divergence report naming the wrong window sends a full-capture re-run
somewhere nothing is wrong, spends the debugging budget, and comes back "no
problem here" -- which reads as evidence the DUT is fine.

The sweep drives 331 cases: every run length around the interval boundary
(1, 2, 4095, 4096, 4097, 8192, 8193, 10000, 12288), a corruption at every
position for short runs and a randomised sweep for long ones, and a different
observable field perturbed each time so it is not silently exercising one field
forever. The PRNG is eight lines rather than a dependency: this crate emits the
goldens an external implementation is verified against and its lockfile is now
committed, so each dependency added here is one more thing that can move
underneath a provenance artifact.

IT FOUND A REAL DEFECT ON ITS FIRST RUN, AT len = 1

A divergence at cycle ZERO was reported in a window that did not contain it.

Divergence::after_cycle was a u64 in which 0 meant both "no prior checkpoint"
and "cycle zero" -- a sentinel colliding with a legitimate value. So the first
window read as (0, 0], which is empty, and a full-capture re-run of it would
have found nothing. "Nothing found" reads as evidence the DUT is fine.

Fixed by removing the collision rather than special-casing it: after_cycle is
Option<u64>, None meaning the first window, whose span begins wherever the run
began. Divergence::contains is offered so call sites do not reimplement a
boundary that is half-open at one end and open-ended at the other -- the same
reasoning that put is_single_scanline in rustynes-probe's divergence module.

window_len returns Option<u64> for the same honesty: for the first window the
span starts where the run started, and a checkpoint stream carries no evidence
that it started at cycle 0. The answer is "unknown", not an assumed
through_cycle + 1. checkpoint_diff prints that case open-ended:

  DIVERGED at checkpoint 0
    window to re-run with full capture: cycles from the start of the run
    through 4103 inclusive

rather than "(0, 4103]", which would have excluded cycle 0.

Note this defect was NOT reachable through the CLI's normal use before the
sweep existed -- every hand-written test put its corruption in a later window,
because that is what a person picks. len = 1 is the case a hand-written test
set omits, and it is the only one that exposes the collision.

Both halves are demonstrated to fail. A one-character mutation to
Divergence::contains (`<=` to `<`) reddens two tests, not one.

One local #[allow] added with its reason: clippy::match_same_arms wants the two
`false` arms of the gate predicate merged. They stay apart because they name
two DIFFERENT failure modes and the comments on them are the point of the
function -- merging deletes exactly the distinction the predicate exists to
draw.

Gates. The emulation core is untouched; no file under
crates/rustynes-{cpu,ppu,apu,mappers,core} changes, so AccuracyCoin 141/141 and
nestest 0-diff hold by construction.

  fmt (workspace and the excluded crate), clippy on both, rustdoc -D warnings
  on both, markdownlint on both changed documents.

  126 workspace suites / 2223 passed / 0 failed
    4 excluded-crate suites /   39 passed / 0 failed  (was 35)