[M1-DET-04] Bit-exactness CI: per-tick hash baselines, hello --expect, detcheck matrix

[offdev]

What

Activates laige-detcheck with the real M1-SAMPLE-01 scenario (roadmap M1-DET-04):

• Committed per-tick hash-stream baselines — samples/hello/baselines/, one per SimMath backend (fixed_point_16_16, float_pinned_32), 301 lines each, generated from the reference build (canonical Debug g++). Regeneration policy: deliberate documented scenario/config/engine-hash changes only, always re-verified cross-compiler, recorded in the report.
• hello --expect BASELINE — the scenario-side equivalent of laige-replay --expect (the scenario binary carries the check because a game log cannot be replayed by laige-replay; ADR 0002 replay identity). Same contract: 0 match / 1 first-divergence report / 2 baseline read/contract error. O(1) per tick; kept in hello-baseline.cpp so hello.cpp stays at 99 code lines (PRD 9.4 budget).
• hello-fp32 build variant — the same game source on float_pinned_32 (the LAIGE_HELLO_BACKEND macros; one op surface, two backends, ADR 0002).
• CI wiring (PRD 14 cadence, every merge):
  • every P0 OS job's ctest asserts per-tick identity against the baselines on both backends (hello_baseline_fpx / hello_baseline_fp32) plus the failure fixtures (first divergence, stream length, malformed line, missing file);
  • the merge detcheck job builds four configurations (Debug g++, Debug clang++, Debug+ASan clang++, Release g++) and runs the two-configuration pairs — pair A: g++ vs clang++ Debug; pair B: Debug+ASan vs Release — both backends, via --run-a/--run-b + --compare-combined, after a reference-baseline sanity check;
  • the PR detcheck job runs the both-backend baseline comparison (tooling cadence, label-independent).
• Determinism report — docs/benchmarks/determinism-matrix.md (AGENTS 12 metadata, ARCH-010 scope statement, the float_pinned_32 per-platform support list generated from matrix results — a desynced pair is declared unsupported, never re-baselined; regeneration policy).

Verification

• 82/82 ctest on all six local trees: canonical Debug g++, clang++ Debug, Release g++, Debug+ASan (clang++), Debug+TSan, shared.
• All four detcheck pairs OK (ticks=301); byte-identical clang++ vs g++ streams (both backends).
• Perturbation proof (the step's Verify clause): kVelocity 1 to 2 in the scratch system MovePlayer makes hello --expect exit 1 with hash mismatch at tick 1 (first divergence); the revert restores exit 0.
• tools/laige-include-lint and tools/laige-determinism-lint OK; zero warnings (NFR-8.10, -Wall -Werror in every tree).

Open until the first merge: the merge detcheck job and the macOS/Windows P0 baseline checks land with this PR's merge; the support-list rows marked pending in the report convert to matrix results (or, for a desynced float_pinned_32 pair, to an unsupported declaration per ADR 0002).

Roadmap: M1-DET-04 checked, board 18/25.