perf(mtp): fused-scan ring capture for batched verify (#209 item 4)

[pekkah]

Follow-up to #209 (work item #4). #209's #1 shipped in #287.

Problem

BatchVerify captures per-token GDN recurrent state into the snapshot ring with gdnSnapRing=true, which forces the per-position recurrence loop (k×8 launches/layer) plus ~96×(k−1) CopyDeviceRegion launches per step (~3 ms at k=4) — instead of the #114-B fused GdnRecurrenceScan path the prefill trunk uses.

Goal

Extend GdnRecurrenceScan to optionally dump each token's post-update (scan, conv) state into the ring slots as it scans, so the verify trunk keeps the fused path and drops the per-position relaunch + the bulk CopyDeviceRegion fan-out.

Notes

• Ring slot layout is per-layer (scan, conv) after batch token j; the fused scan already produces these states transiently.
• Must preserve rollback correctness (RestoreBatchSnapshot reads slot lengthAfter − startPos − 1).

[pekkah]

Implemented in #294.

• llm_gdn_recurrence_scan extended to mirror each token's post-update scan state into the ring during Pass B (zero extra launches); new llm_gdn_conv1d_state_capture_ring captures the per-token conv states in one launch before the in-place state advance.
• Verify now keeps the perf(engine,cpu,cuda): remaining GDN-hybrid prefill headroom after #111/#112 (N-input MoE dots + per-position recurrence/SDPA batching) #114-B fused path instead of the per-position relaunch + the ~96×(k−1) CopyDeviceRegion fan-out.
• Snapshot ring is now flat-contiguous so the kernels can stride across slots; rollback (RestoreBatchSnapshot reads slot lengthAfter − startPos − 1) preserved.

Bit-identity holds by composition over the proven #114-B fused path; new model-free bit-exactness oracles + the 27B-MTP parity/rollback/e2e tests pass in both default and SHARPI_BATCHED_GDN_SCAN=0 modes.