pgw#988 (P0): the publish declare and the discovery filter are ONE contract

[PaulFidika]

The regression

c2e52f5f (th#1645 + pgw#987, PR #507) added entries to
fleet_cells._UNBOUNDED_ENVELOPE_BLOCKS, so control_plane_metadata strips it
from the publish declare. That is correct about SIZE — entries is unbounded in
the model, the declare is a control-plane call, and the change fixed a real 413
that had refused every AOT cell publish thirty-two times across two cards.

But aot_cells._candidates verifies the hub listing metadata — which IS the
declare body — with the FULL aot_serve.verify, entries map and all. So from
c2e52f5f every AOT cell published by any worker is rejected on every pod:

aot-cells: ck5-… filtered: malformed declared contract: metadata declares no entries map
aot_cell_discovery miss: no matching aot-inductor cell among 1 checkpoint(s)
    — rejected by class: verify:malformed declared contract: metadata declares no entries map=1

A pod that finds no cell mints its own, so the fleet re-mints on every cold boot
and the failure presents as cost, not as an error. Found by the pgw#978 rig,
whose cycle (mint → publish → a second process adopting) is the only thing
in-tree that crosses the seam.

The fix — a split, not a revert

Restoring entries to the declare re-creates th#1645, so the check moves to the
side of the fetch that has the data:

	rules on	called from
aot_serve.verify_declared	DECLARED_AXES: format, kind, code-only flag, sm/torch/cuda, host ISA, family	aot_cells._candidates, pre-download
aot_serve.verify_contract	the entries map + per-entry range_digest/class_hash + ck6 combined hash	stage_artifact, on the unpacked metadata.json
aot_serve.verify	both	callers holding a full envelope

Nothing is checked less than before. entries rides inside the artifact and
aot_serve has always read it from there to serve; it is now verified there
too, before anything is dlopen'd. The pre-download filter still refuses every
axis a declare CAN carry, by its own class, with no bytes moved (asserted).

The authority the contract lacked

The cause is two independent computations of one fact — what a declare must
carry — in two modules, so a change to one side could not see the other (the
pgw#985 defect class, one layer up). Now:

• aot_cells.DECLARE_CONTRACT_KEYS — every key the pre-download filter reads;
• fleet_cells.assert_declare_contract() — runs at import, raises when
  _UNBOUNDED_ENVELOPE_BLOCKS intersects it.

The next block that moves fails every test run rather than a fleet.

Test evidence

tests/test_cell_declare_verify_split_pgw988.py — the rig's own seam as a CI
row, minus the card: a real CellPublisher.publish over a real socket into a
hub that stores the declare it actually received, then a real
aot_cells.discover reading that same body back off a real checkpoint listing
and pulling the real artifact bytes the publisher uploaded. Nothing between the
two halves is stubbed; only the two hardware probes (runtime_key, the torch
read inside host_isa.stamp) are pinned, and the ISA machine/level stay this
host's real ones.

Every existing discovery test hands _candidates a full envelope no publisher
has ever put on the wire — which is why the whole suite stayed green through the
regression.

• RED on a clean origin/master src tree: 7/7 fail, with the verbatim
  reject class verify:malformed declared contract: metadata declares no entries map.
• GREEN here: 7/7 pass.

Also asserted: the declare still carries none of the four unbounded blocks and
stays under CELL_DECLARE_MAX_BYTES on the same wire that now yields an
adoption — the fix does not undo th#1645.

Gates (run locally; GitHub Actions is in a major outage)

• pytest tests/ -n 4 --dist loadfile — 3300 passed, 37 skipped, 1 xfailed
• pytest tests_v2/ -n 4 --dist loadfile — 21 passed
• mypy src/gen_worker — clean, 231 files
• ruff check src/gen_worker tests/test_cell_declare_verify_split_pgw988.py — clean
• scripts/lint_http_timeouts.py, scripts/lint_unreached_surface.py,
  scripts/lint_config_reads.py — all exit 0

Release

No version bump in this PR. This needs to reach the fleet: unadoptable cells
cost a full compile per cold boot on every serving pod, so it should ride the
next release train (0.93.2, already queued for the attempt-24 gate hardcut and
ck5→ck6) rather than be published solo. Recorded in the tracker.

Closes pgw#988.

[PaulFidika]

Coordination note: PR #512 (the 0.93.2 train) titles itself as including 'the declare/verify contract is split' — the same pgw#988 fix this PR carries. Whichever lands first: if #512 lands, verify content parity with this branch (tests/test_cell_declare_verify_split_pgw988.py must be present and green) then close this PR as superseded; if this lands first, #512 should rebase. Do not merge both blindly. Tracker record: pgw#988 section, commit f4b22cdd.