[tools, android-plugin, CI] (P7): the device matrix runner selects DirectVulkan, repeats are archived, and the spawn env parse is entry-aware

wave 0 item 5. Three instruments P7's device window needs, and the CI steps that
can make each of them red.

run_tcp_matrix.py --backend DirectVulkan end to end. --backend already existed and
already filtered by each case's ci_backends; what did not exist is a per-backend
GOLDEN. The two backends shared `golden` plus an optional `alternate_golden`, and
alternate_golden is an OR across backends, not a per-backend key - so a
DirectVulkan run that matched the DirectGLES picture passed, which is the "went
green on the wrong arm" shape the exit gate exists to catch. trace_cases.json
gains `backend_overrides.<backend>` ({golden, alternate_golden, ssim_threshold}
only: restating target_call or a crop would stop the two backends retracing the
same frame through the same window). A per-backend golden REPLACES the shared
pair, matching another backend's declared image is refused BY NAME, and a --case
named explicitly that does not run a requested backend is an error instead of one
plan fewer and no message. The CMake emitter and the APK matrix refuse a case that
declares the key rather than silently emitting one golden for both arms.

DirectGLES is unchanged and that is asserted, not asserted-in-prose: a case with no
override resolves to itself, and the key is dropped from the resolved case even for
the backend that overrides nothing - so giving DirectVulkan its own golden does not
move the DirectGLES identity fingerprint and does not invalidate its checkpoints.
Each results.json row now records the golden, alternate golden and threshold it was
scored against.

run_android_retrace_local.py gets --matrix (the CI split subset, 39 cases, each
running only its own ci_backends - not --all, which adds the rd12 workload ID-P7-4
excludes), --repeat N, and --archive-dir. The archive is the point: the result root
is keyed by case and backend and by NOTHING else, so repeat 2 overwrites repeat 1
and the only artefact that survives a three-repeat run is the last one, which makes
"were the three repeats the same picture?" unanswerable after the fact - in the one
place where re-running to find out is expensive. It also refuses --benchmark with a
non-monolith --transport, which has always produced a monolith run under a spawn
label (run_benchmark_case passes args.env alone; p6/README.md records the pitfall).

compare_actuals.py computes the pair result.json cannot: SSIM between two actual
PNGs, plus a case x repeat x ssim-vs-golden x ssim-vs-first-repeat table over an
archive. It is the retrace gate's OWN SSIM - a transcription of ComputeChannelSsim
/ ComputeRgbSsim (trace_replay_core.cpp:630/:671), the only SSIM in the tree - and
the crop comes from each repeat's own result.json, so the two columns describe the
same rectangle. PNG decode is stdlib zlib, because an unavailable Pillow in the
device window would turn "the repeats diverged" into "the tool did not run".

TraceReplayActivity: resolveSpawnServerPath's two decisions were String.contains()
on the whole joined K=V;K=V list and neither was entry-aware. The one that bit:
`--env MOBILEGL_IPC_SERVER_PATH` with no '=' is the documented UNSET spelling
(trace_env_overrides_test.cpp:92) and the only way to ask for "spawn with no image"
and watch LaunchServer refuse by name - it did not match "MOBILEGL_IPC_SERVER_PATH="
so a resolved path was appended AFTER it and, because ApplyEnvOverrides applies in
order with setenv(...,1), the deliberate unset was silently undone. That is exactly
the "silently replacing it would make that knob untestable" the method's own comment
forbids. Two more: the key inside another entry's VALUE flipped both decisions the
wrong way, and the transport match was case-sensitive while ConfigLoader lower-cases
the value before matching (ConfigLoader.cpp:322). The parse moves to
SpawnServerPath, a class with no android.* import, so test_android_lifecycle.py
compiles and runs it with plain javac - the parse had no host-side coverage at all,
and its on-device failure mode is "the knob had no effect".

Only spawn gets a path, deliberately: it is the only transport that execs an image.

Red-once, all four: a stub case whose result names the DirectGLES golden fails a
--backend DirectVulkan run with "matched a golden another backend declares"; a
synthetic PNG pair with a closed-form SSIM (identical = 1.0 exactly, constant
black vs white = C1/(255^2+C1), inverted halves = (C2-2v)/(2v+C2)); the pre-fix
resolveSpawnServerPath body fails eight of SpawnServerPathTest's checks; and the
DirectVulkan TCP proof battery is the DirectGLES one under the other prefix,
because an empty prefix selection raises nothing and reads as a clean pass.

CI: test_run_tcp_matrix.py and test_compare_actuals.py join the R-16 step. The
matrix driver's stub regressions had NO CI step - they were run by hand and
recorded in a note - and they guard the tool that decides whether a device golden
run passed.

Counts in WSL: test_run_tcp_matrix 12 -> 18, tcp_lane_tools 4 -> 6,
test_compare_actuals 12 new, test_android_lifecycle green with the new Java unit.

scripts/ci/tcp_lane_tools_test.py

@@ -23,33 +23,69 @@ def module(name):
 
 
 class Accounting(unittest.TestCase):
-    def test_each_tcp_case_needs_a_real_endpoint_and_pid(self):
+    def check_tcp_proof(self, backend):
         tally = module('junit_tally')
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
-            name = 'DirectGLES.Tcp.TriangleScenario.Draw'
+            prefix = backend + '.Tcp.'
+            name = prefix + 'TriangleScenario.Draw'
             junit, discovery, base = root / 'junit.xml', root / 'lane.json', root / 'case.log'
             junit.write_text(f'<testsuite><testcase name="{name}" /></testsuite>')
             discovery.write_text(json.dumps({'tests': [{'name': name, 'properties': [
                 {'name': 'ENVIRONMENT', 'value': ['MOBILEGL_LOG_FILE_PATH=' + str(base)]}]}]}))
             role = root / 'case.client.log'
             role.write_text('control=tcp data=stream server=127.0.0.1:40613 pid=42\n')
-            tally.require_tcp_proof(junit, 'DirectGLES.Tcp.', discovery)
+            tally.require_tcp_proof(junit, prefix, discovery)
             with self.assertRaises(ValueError):
-                tally.require_tcp_proof(junit, 'DirectGLES.Tcp.', discovery, require_run_ahead=True)
+                tally.require_tcp_proof(junit, prefix, discovery, require_run_ahead=True)
             armed = 'control=tcp data=stream server=127.0.0.1:40613 pid=42\nrun-ahead ARMED\n'
             role.write_text(armed)
-            tally.require_tcp_proof(junit, 'DirectGLES.Tcp.', discovery, require_run_ahead=True)
+            tally.require_tcp_proof(junit, prefix, discovery, require_run_ahead=True)
             for fallback in ('running lockstep', 'run-ahead DISARMED'):
                 role.write_text(armed + fallback)
                 with self.assertRaises(ValueError):
-                    tally.require_tcp_proof(junit, 'DirectGLES.Tcp.', discovery, require_run_ahead=True)
+                    tally.require_tcp_proof(junit, prefix, discovery, require_run_ahead=True)
             for bad in ('', 'control=tcp data=shm server=127.0.0.1:40613 pid=42',
                         'control=tcp data=stream server=127.0.0.1:40613 pid=0',
                         'spawn ARMED - the server role runs in pid 42'):
                 role.write_text(bad)
                 with self.assertRaises(ValueError):
-                    tally.require_tcp_proof(junit, 'DirectGLES.Tcp.', discovery)
+                    tally.require_tcp_proof(junit, prefix, discovery)
+
+    def test_each_tcp_case_needs_a_real_endpoint_and_pid(self):
+        self.check_tcp_proof('DirectGLES')
+
+    def test_the_directvulkan_tcp_lane_is_held_to_the_same_proof(self):
+        """P7 exit gate 3 runs this lane on Magma, and the proof is prefix-driven.
+
+        `require_tcp_proof` selects by test-name prefix, so a DirectVulkan sweep asks it for
+        `DirectVulkan.Tcp.` - a prefix nothing in the tree had ever passed it. An empty
+        selection raises nothing at all, so a whole-backend typo would have read as a clean
+        pass; running the identical positive and negative battery under the other prefix is
+        what makes that impossible.
+        """
+        self.check_tcp_proof('DirectVulkan')
+
+    def test_a_prefix_that_matches_nothing_is_not_evidence(self):
+        """The shape the test above guards against, stated on its own.
+
+        require_tcp_proof iterates the testcases whose name starts with the prefix and asserts
+        per case. With no match it iterates nothing and returns, which is indistinguishable from
+        "every case proved its arm" - so the CALLER has to count, and this records that the
+        function itself will not.
+        """
+        tally = module('junit_tally')
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            junit, discovery = root / 'junit.xml', root / 'lane.json'
+            junit.write_text('<testsuite><testcase name="DirectGLES.Tcp.A" /></testsuite>')
+            discovery.write_text(json.dumps({'tests': []}))
+            tally.require_tcp_proof(junit, 'DirectVulkan.Tcp.', discovery)
+            self.assertEqual(tally.tally(junit, 'DirectVulkan.Tcp.'), (0, 0, 0))
+            # And the same junit under the prefix that DOES match has no private log path, so
+            # the proof refuses rather than passing on the strength of the name alone.
+            with self.assertRaises(ValueError):
+                tally.require_tcp_proof(junit, 'DirectGLES.Tcp.', discovery)
 
     def test_equal_counts_do_not_hide_a_missing_case(self):
         parity = module('spawn_lane_parity')