Refactor: host-build trb runtime arena

[poursoul]

Summary

Move the trb runtime arena's layout + data initialization from AICPU boot
onto host, so each AICPU launch reduces to a cheap pointer-fixup pass plus
the SM reset that can't run off-device. The pooled prebuilt image lives in
a per-Worker DeviceRunner pool and is reused across runs via a single
rtMemcpy — multi-launch boot cost drops from O(task_window_size) per
worker to a constant.

Two related cleanups ride along:

• RingSchedState::init's O(task_window_size) slot-bind loop is lifted
  into per-submit orch::prepare_task, making startup independent of
  window size. The two extra stores hit the same 64B cache line that
  prepare_task already dirties, so the per-submit cost is essentially
  free.
• AICPU SM reset (per-slot bind_ring + reset_for_reuse +
  fanin_count/active_mask zero) consolidated into
  PTO2SharedMemoryHandle::init_header_per_ring so the host-build path
  doesn't dereference SM.

Covers both a2a3 and a5 trb runtimes (platform layer onboard + sim).
hbg is unaffected by the runtime-arena split — its
setup_static_arena(...,0) keeps the third region unreserved.

Mechanism

• runtime_create_from_sm split into four phases that run on either side:
  • runtime_reserve_layout — pure arithmetic; host computes sub-region
    offsets on a libc-backed DeviceArena.
  • runtime_init_data_from_layout — writes standalone fields, memset's
    arena regions, and stores SM device pointers (only stores, no
    dereferences).
  • runtime_wire_arena_pointers — walks every arena-internal pointer
    field and binds it to arena.base() + offset. Idempotent: host runs
    once with the host mirror, AICPU runs once after attach with device
    addresses.
  • runtime_finalize_after_wire — AICPU-only fixup for s_runtime_ops
    (device-side file-local global) and the SPMD core counts from the
    SchedulerContext.
• DeviceArena::attach() wraps an externally-owned buffer with no
  per-attach allocation; re-attach is permitted so each AICPU boot can
  reuse the same pooled image. Pre-alignment / non-null / power-of-two
  checks std::abort() instead of assert() so release builds still
  trap on contract violations.
• pto2_sm_layout namespace computes SM device-side field addresses by
  pure offset arithmetic so host init never reads SM. Takes a per-ring
  task_window_sizes[] array (mirroring the SM API) and asserts
  ring_id in range — structurally prevents the host-built image from
  silently disagreeing with the SM layout.
• New runtime/shared/pto_runtime2_init.cpp holds the host-pluggable
  cold-path lifted from pto_runtime2.cpp / pto_orchestrator.cpp /
  scheduler/pto_scheduler.cpp. AICPU-only ops table / submit_task /
  dispatch / business logic stay in their original files.
• DeviceRunner now owns three independent pooled arenas —
  gm_heap_arena_, gm_sm_arena_, runtime_arena_pool_ — one
  device_malloc each. Split out from a single backing allocation
  because the combined size can exceed the device allocator's largest
  contiguous block. setup_static_arena(gm_heap_size, gm_sm_size, runtime_arena_size) commits each region independently;
  acquire_pooled_runtime_arena() returns nullptr when the region is
  unreserved (hbg's setup_static_arena(...,0) path) so misuse is loud,
  not undefined.
• bind_prepared_to_runtime_impl (host runtime_maker) does the full
  reserve_layout → init_data → wire on a host arena, stashes the layout
  inside the PTO2Runtime image at prebuilt_layout, then rtMemcpys
  the whole arena into the pooled device region.
• Dead fields and parameters dropped: PTO2TensorMap::orch back-pointer
  (never dereferenced), PTO2Runtime::prebuilt_arena_base mirror (host
  Runtime::prebuilt_arena_base_ is the real source of truth), unused
  task_window_size / dep_pool_capacity from
  PTO2SchedulerState::init_data_from_layout and
  RingSchedState::init_data_from_layout (scheduler only needs SM base
  • ring index, both window-size-independent).

Test plan

• cpput: 25/25 pass. ready_queue / spsc_queue / scheduler_state /
  task_state / wiring / tensormap UTs migrated to the data+wire API.
  task_allocator.init grew an optional initial_local_task_id
  (default 0) so the near-INT32_MAX corner case is still exercised
  without reading the SM.
• a5sim: L2 trb 21/21 + L2 host_build_graph 6/6 pass.
• a2a3sim: L2 trb 29/29 + L2 host_build_graph 9/9 pass.
• a2a3 hardware: tests/st/.../paged_attention_unroll passes on
  device 9 (--build, pto-isa commit pinned to CI).

[gemini-code-assist]

Code Review

This pull request implements a prebuilt-arena fast path for the PTO2 runtime, allowing the host to pre-compute the runtime arena image and upload it to the device. This optimization reduces AICPU boot time by replacing full initialization with a simple attachment and pointer "wiring" phase. Key changes include refactoring the initialization logic for the runtime, orchestrator, and scheduler into separate data-population and pointer-wiring stages, extending the DeviceRunner to manage a pooled runtime arena, and adding an attach method to DeviceArena for externally-owned buffers. Review feedback correctly identified potential undefined behavior in the new acquire_pooled_runtime_arena methods when the arena is not provisioned, suggesting defensive checks against SIZE_MAX offsets.