Review remediation: close all 3 blockers and 27 warnings/suggestions

[nyo16]

Remediates /phx:review's BLOCKED verdict on the v0.8.40 audit-remediation
change set. Executes .claude/plans/audit-review-fixes/plan.md in full: 33 of 33
tasks, covering 3 blockers, 21 warnings and 6 suggestions. The 12 deferred
suggestions are untouched and still need your call.

v0.8.40 is unreleased (latest tag is v0.8.25), so this folds into that section of
the CHANGELOG rather than inventing a version.

The three blockers

	Defect	Fix
B-3	{:ok, sampler} = Sampler.create(...) inside init_slot/4 crashed a model-holding GenServer on a caller-supplied :grammar. Backing servers run restart: :temporary, so
it never came back.	New validate-only grammar_validate NIF (no chain allocated) + Sampler.validate_grammar/2. All five public entry points and subscribe_stream_tokens/4 reject at
admission; init_slot/4 keeps a case as depth-2 defence that fails the request.
B-1	Three llama_memory_seq_rm call sites took an unchecked seq_id outside any batch, so upstream's validation never saw it and GGML_ASSERT aborted the VM.	Guarded,
each keeping its NIF's existing error type. Break-verified: removing embed_decode's guard exits the OS process with SIGABRT.
B-2	MTP.stream_events/3 returned an infinite stream on setup failure — failure was signalled by adding a :setup_error key instead of flipping the discriminant, so the
halt clause never matched and generate/3's Enum.to_list/1 hung with a growing heap.	Halt clause ordered first, with regression tests driven through a Task so a recurrence fails
instead of wedging the suite.

Two guards, because manual review missed these classes repeatedly

The widened-contract class was missed four times, three of them by the change
set that was fixing it. The NIF gap survived a break-verification that only proved
the guards someone had already thought of were load-bearing.

• option_forwarding_test.exs now asserts the containment invariant itself:
  every key an outer gate accepts is accepted by every inner gate it routes to,
  except what the outer consumes. Break-verified in both directions.
• nif_guards_test.exs replaces a hand-picked subset (7 of 15 seq_id-bearing
  NIFs — missing exactly the three unguarded ones) with a @seq_id_surface table
  of 17 argument positions and four outcome classes, checked against nif.ex's own
  source so a new seq_id-taking NIF fails the suite until it is classified.

The containment guard found a fifth instance on its first run: :template was
documented on chat/3 and chat_completion/3, accepted by @chat_opt_keys, and
read by nothing. Removed.

Three findings the remediation itself turned up

1. IO.binwrite/2 does not return {:error, reason} — it calls
   :erlang.error(reason). So W-14's stated mechanism was wrong and the blast
   radius was larger: a full disk raised out of Req's streaming callback and past
   download/3 into the caller's crash report, with :token in the stacktrace.
   Switched to :file.write/2.
2. kv_quantization_test.exs asserted byte_size(text) > 0, which measures the
   model's willingness to speak rather than the KV cache. Pre-existing and invisible
   because :slow had never run anywhere — and a blocker for enabling it in CI.
3. Two allowlists alone would have swallowed option typos in
   ModelManager.load/3, because the denylist W-13 replaced was doubling as the
   typo gate. Closed with an outer gate on the union.

Breaking changes

All in the unreleased v0.8.40 section, each with its rationale:

• Hub caches under <repo_id>/<revision>/<filename> — revision was absent from
  the key, so revision: "<sha>" returned the cached main copy and the pin bought
  nothing. Existing caches re-download once.
• A download whose file has no published SHA-256 now fails. :verify_checksum
  is true (fail closed) / :best_effort / false; anything else is rejected
  rather than treated as truthy. Verification used to be downgradable by the
  metadata response — strip one JSON key and the bytes were cached unverified.
• Server.stream/3 and stream_tokens/3 emit {:error, :timeout} instead of
  truncating silently, and cancel server-side.
• :template is gone (see above).
• The server-routed facade rejects start-time options up front instead of raising
  from inside Server.complete_tokens/3 — a function the caller never called.

Verification

Every gate green, and every new acceptance criterion break-verified.

Gate	Baseline	Now
mix compile --warnings-as-errors --force	clean	clean
mix format --check-formatted	clean	clean
mix credo --strict	0 issues	0 issues (768 mods/funs)
mix dialyzer	0 errors	0 errors
mix test	320 / 118 excluded	371 / 139 excluded
--include smoke --include embeddings --include slow	:slow never ran	499 / 11 excluded
--include smoke, GEN model only	failed (W-21)	479 / 31 excluded
--include slow, GEN model only	never run	381 / 129 excluded
--include embeddings, EMB model only	n/a	381 / 129 excluded
C1 Hex-tarball source build	rc=0	rc=0, NIF loads, devices/0 works

51 tests added to the default suite (320 → 371), 82 across the full matrix
(417 → 499). No erl_crash.dump from any test run.

Break-verifications performed: containment test (both directions + orphan keys),
enumerated NIF surface (SIGABRT on guard removal, coverage test on a new NIF),
TestSlots drift, B-2 clause order, W-5 cancel-on-abandon, W-6 timeout element.

CI additionally now runs each gate tag alone, so the one-tag-per-suite
invariant the taxonomy rests on is checked rather than trusted.

Two things to know

• MTP is compile-verified only. W-7 reroutes three llama_decode calls in the
  MTP path through decode_tracked, and no MTP-capable GGUF is available locally
  (Qwen3.5-0.8B has no MTP head — mtp_test.exs fails in Context.create before
  any decode, both before and after this change). The three sites are a provable
  no-op on decode semantics: sp.ctx_tgt->ctx is the same pointer the local held.
• W-4's error branch is not directly exercised. It is reachable only from a
  state_seq_get_data failure, and save/4 checks state_seq_get_size > 0 first,
  so the two would have to disagree. There is no NIF-level fault injector in the
  suite.