[cshintov]

What this changes

• Every chip checks every chip's qwen27 control edits. Suite.collect in metal_q27_attn_rows.zig first builds the attention source for both tensor-unit settings and requires each control's edit to occur exactly once. On a mismatch it prints which control, which setting and the count, and returns error.ControlEdit.

Why: #2106's last commit changed q27_attn_prefix's line to MASKED && q27_nonfinite(, and the M5 decode control's edit went stale (fixed in 207ebc7fd). Before M5 the decode control isn't registered, so a pre-M5 run never built that edit, and our M4 contract passed. With this check, a pre-M5 run fails on a stale M5 edit too.

• Issue: follow-up to qwen27: a masked key's non-finite value adds nothing to the rows that must not see it #2106.
• Stacked on: main.

Design

Choice: check the edit's source text once, up front, for both settings, on every chip. It reads source only, so it costs milliseconds and needs no device with tensor units.

Alternatives considered:

• Register the M5 decode control on pre-M5 chips too: it would dispatch a kernel built for tensor units on a chip without them.
• Leave it to M5 runs: that is how the stale edit slipped through qwen27: a masked key's non-finite value adds nothing to the rows that must not see it #2106.

Checks

• Head on main 4ddc28cfc, an M4 Pro (no tensor units).
• tf-kernel-contract --only qwen27: SUMMARY 30 kernels: 30 pass gates 1-4, 0 fail, 0 known findings; 3 controls: 3 red as planted, 0 missed; 0 limit problems, exit 0.
• With the decode edit's from put back to const bool masked = q27_nonfinite( (the text before 207ebc7fd), the same run on the M4 exits 1: control edit for decode rows (tensor units true) matches 0 times, not once: const bool masked = q27_nonfinite(, then error: ControlEdit.
• zig fmt --check: clean. tools/pr_check.py: 0 errors, lean 341 against 341 (0 new).
• Not run: the M5 contract. The check only reads source text, so it does the same on an M5.