ci: run the kernel host-KAT gates on every PR (lane K, F8)

[MauroToscano]

Lane K follow-up F8: the kernel host-KAT gates run on every PR.

Why

make test-blake3-host-kat and make test-rpx-host-kat compile the real .cu sources as host C++ through crypto/math-cuda/tests/host_kat/cuda_host_shim.h and run them against external vectors (official BLAKE3, miden-crypto RPO) and the committed oracle tables — g++ only, no CUDA, no cargo, seconds. They were in no workflow: gpu-tests.yml runs on merge_group only, so an edit to blake3.cu or rpx.cu that broke a hash reached the merge queue before anything noticed.

What changes

One file, .github/workflows/pr_main.yaml:

• New job host-kat (Host KAT (kernel pins), ubuntu-latest, same if: as the other jobs, actions/checkout@v4 only — no Rust setup, no caches), three steps:
  1. make test-blake3-host-kat (7-round and 6-round arms);
  2. make test-rpx-host-kat (permutation, leaf sponge, parent, the seven leaf kernels and both Merkle compressors replayed through the shim);
  3. make test-blake3-second-source — the check on the TABLES the BLAKE3 host-KAT trusts (upstream BLAKE3's portable C with a parameterised round loop vs the committed 6-round vectors and the Python oracle). Included because it is the same class of gate, it also lived in no workflow, and every input it needs is tracked (thoughts/blake3/reference-impl/{driver.c,upstream/*}, thoughts/blake3/blake3-oracle/*, crypto/crypto/src/hash/blake3/vectors.rs); cc and python3 are on the runner. Drop the step if the scope should stay at the two host-KATs.
• The Test gate: host-kat added to needs, its result echoed and checked like the others, so the pins gate merges rather than merely run.

No Makefile change: all three targets exist at the tip (test-rpx-host-kat since #952's merge).

Evidence

Local, from a cold target/host_kat, laptop (clang, M-series):

make test-blake3-host-kat      2.47 s wall   ALL HOST KAT CHECKS PASS   (both arms)
make test-rpx-host-kat         1.31 s wall   ALL HOST KAT CHECKS PASS
make test-blake3-second-source 3.08 s wall   RESULT: ALL GREEN -- two independent sources agree on the ten 6-round vectors, and the 7-round anchor is external.

git status clean afterwards (the reference binaries are gitignored). YAML parsed with Ruby's YAML.load_file: jobs lint, test-executor, test-cli, host-kat, test, test-disk-spill, test-stark-cuda-lib, build-prover-tests, test-prover, test-prover-comprehensive, seed-elf-cache; test.needs = test-executor, test-cli, test-prover, test-disk-spill, test-stark-cuda-lib, host-kat.

Prediction

Job wall time 30–60 s: about 7 s of work locally, 1.5–3× that under g++ on the runner (≤ 20 s for the three steps), plus checkout and runner start-up. It should be the shortest job in the workflow by an order of magnitude; the gate's critical path is unchanged.

Not covered

Arithmetic only. nvcc acceptance, register pressure and execution stay with gpu-tests.yml on merge_group.