[Feat] (Bench, Pipe): run the blend-toggle case in CI, give G7 a negative control, and record the two campaign devices

- DriverBenchStateToggle runs mc_state_toggle as its own ctest entry. The case has been in
  kBenchCases since P0 and nothing executed it, so nothing would have noticed it rotting - and it
  is the exact enable/draw/disable/draw shape the microbenchmark P2 owes the GO/NO-GO measures.
  About 1.2 s inside an existing three-minute job.
- scripts/g7_negative_control.sh breaks the pipeline/dynamic split on purpose: it inserts two
  boundaries so ColorMasks becomes a dynamic chunk of its own, which keeps the partition sorted,
  non-overlapping and complete - so it still COMPILES - while making glColorMask bump
  m_pipelineStateVersion without moving the pipeline-subset hash. A non-zero ctest is the pass.
- Everything that could make that control lie is refused rather than reported: a missing
  SetterConsistency test exits 2 instead of reading "no tests matched" as a failure; a tree that
  is already red or already broken exits 2; a patched table that does not compile exits 2, since
  a build break would prove the static_asserts work rather than that the test still checks; and
  the restore is from byte-for-byte copies (never from git, so a dirty tree is given back
  intact), followed by a rebuild and a re-run that must be green. --verify-patch-only exercises
  the mechanism where the test does not exist yet and says explicitly that it is not a pass.
- Profiles for the two campaign devices, and the guard that stops them being trusted early. Both
  carry PROFILE_VERIFIED=0 and every device-specific field is TODO_VERIFY_ON_DEVICE rather than a
  guess: the harness pins through MediaTek nodes and 35d0befa is a Qualcomm part, where
  `su -c 'echo ... > /proc/ppm/...'` fails with a zero exit and the run would report numbers it
  believes were pinned. bench.sh and session.sh now refuse an unverified profile unless
  --allow-unverified-profile is passed, which warns that the run is not comparable with a pinned
  one. The README records what earns PROFILE_VERIFIED=1.

tools/device_bench/README.md

@@ -30,6 +30,25 @@ frequency-pin integrity.
 5. Root required (frequency pinning, GPU busy sampling).
 6. Write a device profile under `devices/` (see `devices/odinlite.env`).
 
+   A profile carries `PROFILE_VERIFIED=1` only once its sysfs nodes and OPPs have been read
+   off *that* device and one pinned window has been checked against them
+   (`big_cur`/`little_cur`/`gpu_cur_khz` in the result JSON must match the pins). Until then
+   it says `PROFILE_VERIFIED=0` and `bench.sh` / `session.sh` refuse to run against it unless
+   `--allow-unverified-profile` is passed, which labels the run unpinned in the warning.
+
+   That refusal exists because the pin path is silent when it is wrong: the harness writes
+   through `/proc/ppm/policy/hard_userlimit_*` and `/proc/gpufreq/gpufreq_opp_freq`, which are
+   MediaTek nodes, and `su -c 'echo ... > /proc/...'` against a device that has neither fails
+   without a non-zero exit. The run then reports numbers it believes were taken under a pin.
+
+## Devices
+
+| profile | device | verified |
+|---|---|---|
+| `devices/odinlite.env` | AYN Odin Lite, MT6877 / Mali-G68 | yes |
+| `devices/xiaomi-adreno830.env` | Xiaomi, Snapdragon 8 Elite / Adreno 830 (`35d0befa`) | **no** - Qualcomm pin path not yet taught to `bench.sh` |
+| `devices/oppo-mali.env` | Oppo / ColorOS, MediaTek + Mali (`3B159D009VZ00000`) | **no** - OPPs and thermal zone not yet read off the device |
+
 ## Usage
 
 ```