[Fix] (Trace, Bench, CI): compute p50 by the device's own median rule, fail the profile guard closed, and give the new control step its sibling's environment

- format_benchmark printed a p50 taken with the nearest-rank rule beside a medianFrameCpuMs the
  device computes as the average of the two middle frames, and documented the two as one rule; on
  an even window they differ (the pre-flight printed p50=8.261ms next to medianCpuMs=271.766).
  p50 now goes through series_median, which is SummarizeSeries' rule transcribed; p95 and p99 stay
  nearest rank, which is the device's rule for p95 and the honest extension of it for the p99 the
  device does not compute at all
- require_verified_profile treated a profile that simply omits PROFILE_VERIFIED as verified, which
  is the fail-open default a profile written by copying another one inherits - exactly the case the
  guard exists for. It defaults to unverified now, odinlite.env carries PROFILE_VERIFIED=1
  explicitly (it is the one profile that earned it), and the refusal says "says 0, or says nothing"
- the two new profiles claimed profile.sh refuses an unverified profile; it has no such check and
  needs none - it records a simpleperf profile and pins nothing. The claim is corrected in both
  profiles and in the README rather than a guard added where there is nothing to guard
- the handle-ABA / CSO control step in test.yml set only MOBILEGL_ITEST_REQUIRE_GPU while its
  sibling verify step sets the three MOBILEGL_MAGMA_* fixes and arms core dumps. It runs the same
  DirectVulkan binary on the same runner, so a crash there left no core; it now carries both

tools/device_bench/devices/odinlite.env

@@ -3,6 +3,12 @@
 # Panel: 1080x1920 @ 60Hz (presented FPS caps at 60 - render-side FPS comes from the
 # FCLFPS logcat tag, which counts eglSwapBuffers; it is NOT vsync-capped when the
 # game runs with vsync off).
+# Read off this device and confirmed against one pinned window (big_cur/little_cur/gpu_cur_khz
+# in the result JSON matched the pins), which is what earns the key. bench.sh / session.sh refuse
+# a profile without it: the default is UNVERIFIED, so a profile written by copying this one starts
+# out refused until somebody repeats that check on the new device.
+PROFILE_VERIFIED=1
+
 DEVICE_SERIAL=MTK0002207301023500
 
 # Frequency pins, enforced via /proc/ppm/policy/hard_userlimit_* (plain cpufreq

tools/device_bench/devices/oppo-mali.env

@@ -5,8 +5,9 @@
 # repository rather than in one operator's shell history.
 #
 # ============================ NOT YET DEVICE-VERIFIED ============================
-# PROFILE_VERIFIED=0, and bench.sh / session.sh / profile.sh refuse to run against it unless
-# --allow-unverified-profile is passed. This part is a MediaTek SoC, so unlike the Adreno
+# PROFILE_VERIFIED=0, and bench.sh / session.sh refuse to run against it - or against a profile
+# that omits the key - unless --allow-unverified-profile is passed. (profile.sh only records a
+# simpleperf profile and pins nothing, so it carries no such guard.) This part is a MediaTek SoC, so unlike the Adreno
 # profile the harness's existing /proc/ppm + /proc/gpufreq pin path is probably the right one -
 # but "probably" is exactly the state a measurement profile must not ship in. The cluster
 # indices, the available OPPs, the top GPU OPP and the thermal zone TYPE all differ between

tools/device_bench/devices/xiaomi-adreno830.env

@@ -6,8 +6,9 @@
 # history, and so that a `--device` argument names something reviewable.
 #
 # ============================ NOT YET DEVICE-VERIFIED ============================
-# PROFILE_VERIFIED=0 below, and bench.sh / session.sh / profile.sh REFUSE to run against a
-# profile that says so unless --allow-unverified-profile is passed. Two of the values here are
+# PROFILE_VERIFIED=0 below, and bench.sh / session.sh REFUSE to run against a profile that says
+# so - or that omits the key - unless --allow-unverified-profile is passed. (profile.sh is not in
+# that list: it records a simpleperf profile and pins nothing, so it has nothing to pin wrongly.) Two of the values here are
 # protocol constants that are known (the campaign pins big 1.96 GHz / little 1.55 GHz and gates
 # at 40 C), but the sysfs node names and the exact available OPPs are NOT: this is a Qualcomm
 # part and the harness was written against MediaTek, where the pin goes through