feat: 0.4.0 — what it claimed, checked against what it did

[vyncint]

Closes #33, closes #34, closes #35, closes #36, closes #37, closes #38, closes #39, closes #40.

The v0.4.0 audit milestone, plus the pin bumps that went with it.

The two correctness fixes

#33 — eigh answered about a matrix the caller did not pass.

A = [[1, 2], [5, 1]]              (not symmetric)
true eigenvalues       [-2.1622777, 4.1622777]     1 ± √10
eigenvalues of (A+Aᵀ)/2 [-2.5, 4.5]
oxmera 0.3.0 returned   [-2.5, 4.5]      <- the second one, no error

It read both triangles and averaged them, so it was not the lower-triangle
convention either — perturbing either triangle moved the answer. Now a typed
error naming the batch index and the worst pair, above EIGH_SYMMETRY_TOL
(1e-5, relative) — the same bound the CPU↔GPU parity suite uses, so a
covariance matrix assembled in f32 still passes. Verified across the
boundary: symmetric works, noise under the bound works, noise over it is
refused, the check is scale-invariant, and a batched input names the matrix
that is actually wrong.

#34 — nothing tied the shipped PTX to the shipped source.

The crate ships the kernels twice and load_module chooses by driver age, so
a mismatch means two users on one published version run different code. The
only guard compared kernel names. Measured:

$ sed -i '53s|fmaxf(x, 0.0f)|fmaxf(x, 1.0f)|' kernels.cu   # wrong relu
$ cargo test -p oxmera-cuda
test result: ok. 3 passed; 0 failed          <- before
test result: ok. 0 passed; 0 failed; 11 ignored

kernels.ptx.source now carries a fingerprint written by the same just ptx
that writes the PTX. The same mutation now fails, naming the command to fix it.

The one the termlens upgrade found

#40 — driving the dashboard through a pty and signalling it:

q       : exit 0                    alternate_screen after = false
SIGTERM : killed by "Terminated"    alternate_screen after = true   cursor (44,36,false)
SIGINT  : killed by "Interrupt"     alternate_screen after = true

The shell was left inside the alternate screen with the cursor hidden and
nothing written to say so. ratatui::init() already installed a panic hook, so
this was the one remaining unguarded exit. Fixed with signal-hook, which
crossterm already puts in the tree — an import, not a dependency — restoring
and then re-raising with the default disposition, so the process still reports
as killed by that signal.

The rest

#35	CUDA was mandatory on every platform including macOS. Now a default-on cuda feature; --no-default-features drops 7 crates (47 → 40), 88 KB of PTX and a pre-main dlopen. Device::Cuda stays a runtime error.
#36	doctor's capability list was six literals frozen before 0.2.0. Rows now live in the crates that implement them.
#37	crates.io descriptions said "CPU and Apple Metal", two releases after CUDA.
#38	mean over an empty extent returned NaN; now a typed error. sum/max keep their identities — those compose under further reduction and NaN does not.
#39	nn is f32; the error said dtype mismatch … in matmul. Now names the layer and the cast.

Pins

reconverge 0.4.0 → 0.5.0, launchbound 2.0.0 → 2.1.0. The other two of the
four did not move — reconverge 0.5.0 still records nightly-2026-04-03 and
cuda-oxide a766fc26 — so this is the one-variable case, and the gate was
re-measured rather than assumed:

cargo reconverge check --strict --cc 7.5    0 deny, 0 confirmed, 0 warning
cargo reconverge check --strict --cc 8.6    0 deny, 0 confirmed, 0 warning
launchbound prune --cc 7.5                  12 clean, 0 refused, 0 tool errors
launchbound prune --cc 8.6                  12 clean, 0 refused, 0 tool errors
+20480 tile                                 4 refused, RC004, deny confidence

Identical to the 0.4.0/2.0.0 result. Recorded as docs/research-baseline.md
§(e), which is explicit that only the verdicts are comparable with the
Apple-Silicon sections above it — the timings were not re-measured on this
machine.

termlens 0.9

The pty tests moved to its idioms: bin!, snapshot_after in place of
wait_until + wait_idle + screen() (one settled instant instead of three,
and it waits on the picture holding still rather than on bytes stopping),
wait_stable after a resize, termlens::Result<()> so a failure prints the
grid. quit() now also asserts the terminal came back, so every dashboard test
is a teardown test.

Two guards that caught their own bugs

Worth calling out, because they are the argument for the design bar:

• The doctor coverage check used report.contains(family) and passed with
  eigh deleted — because weights contains eigh. Now whole-word.
• The first fingerprint wrote FNV-1a's prime as 0x1000_0000_01b3: twelve hex
  digits where 1099511628211 has eleven. The published test vectors now pin it.

Verification

• 155 tests pass, up from 146. just ci exits 0, including the research workspace.
• --no-default-features: clippy clean, 10 tests pass, and a CI job asserts
  cudarc/libloading/ctor/oxmera-cuda are absent from the graph.
• Doctor goldens re-blessed; the diff is four new rows and nothing else.