oxmera 0.5.2 — the autograd round

[vyncint]

oxmera 0.5.2 — the autograd round

A second deep test of the published crates, reaching the autograd surface the
first round never got to. Every fix is reproduced by a test that fails without
it. No public API changed, so semver-checks passes as a patch.

The two that could kill a program

• A deep autograd tape overflows the stack and aborts the process #96 — a deep tape aborted the process. The tape is a linked structure and
  its derived drop recursed once per node: ~20k operations in debug, ~65k in
  release, then fatal runtime error: stack overflow, aborting. An abort
  cannot be caught. AutogradMeta now dismantles the graph with an explicit
  worklist — a 200,000-node tape builds and drops cleanly.
• Degenerate inputs panic, abort, or are silently accepted where a typed error is promised #99 — try_zeros aborted on an allocation the allocator refused.
  vec![v; n] aborts; the try_ prefix exists precisely so the caller can
  handle this. Now try_reserve_exact.

Wrong numbers

• matmul's 0 x infinity result differs by row within one call #98 — matmul disagreed with itself. The single-row path skipped the
  multiply when the left operand was 0.0, so 0 × ∞ never happened there
  while the four-row block produced NaN. One call returned
  [NaN × 8, 0.0, 0.0] for uniform input.
• max/min reductions silently discard NaN, while argmax errors and sum propagates #97 — max/min silently discarded NaN. f32::max returns the non-NaN
  operand, so a NaN that sum propagates and argmax refuses vanished
  through the op on the common path in pooling and attention.

Refusals and messages

• Degenerate inputs panic, abort, or are silently accepted where a typed error is promised #99 — eye(n) wrapped n * n; pad_dim panicked on a bad dim and
  accepted it silently when padding was zero (its sibling cat always
  reported it); kaiming_uniform panicked inside rand on a zero fan;
  slice turned a reversed range into an empty view.
• Errors name an op the caller never called, an index that is in bounds, and a rank limit that does not exist #100 — trace reported an error naming diag, which the caller never
  wrote; index_select reported a negative index as index [0], an index
  that is valid; matmul claimed "supported ranks are 2 and 3" while rank-4
  and rank-5 work.
• Published rustdoc still documents load-time registration; four more doc claims are false #101 — oxmera-tensor's rustdoc still taught load-time registration
  (0.5.0 removed it and updated only oxmera-runtime); check_param_dtype
  promised the wrong error; the README called reshape zero-copy
  unconditionally; top-level --help omitted --json and --seed; no crate
  had docs.rs metadata, so oxmera-metal documented as its Linux stub.

#95 — documented, not changed

The cholesky/logdet/det gradient looked wrong against an elementwise
finite difference: exactly 0.5× below the diagonal and nonzero above it, and
the crate's own gradcheck rejected all three.

I started to "fix" it to a one-sided gradient — and the suite caught me. The
test at gradcheck.rs asserts d logdet/dA = A⁻¹ for a symmetric A,
checked independently against eigh. The symmetrized gradient is a
deliberate, verified contract, matching PyTorch; a one-sided gradient
would silently break anyone optimising over symmetric matrices, whose updates
must stay symmetric.

So the defect was that this was written down nowhere. Tensor::cholesky now
states the convention, why an elementwise gradcheck cannot apply to these
three ops, and what to do instead. It also corrects a second claim in the same
paragraph: the backward pass takes f32 inputs, so an f64 gradient carries
f32 precision — it said f64.

Closes #95
Closes #96
Closes #97
Closes #98
Closes #99
Closes #100
Closes #101