[Feat] (Bench, Pipe): run the blend-toggle case in CI, give G7 a negative control, and record the two campaign devices

- DriverBenchStateToggle runs mc_state_toggle as its own ctest entry. The case has been in
  kBenchCases since P0 and nothing executed it, so nothing would have noticed it rotting - and it
  is the exact enable/draw/disable/draw shape the microbenchmark P2 owes the GO/NO-GO measures.
  About 1.2 s inside an existing three-minute job.
- scripts/g7_negative_control.sh breaks the pipeline/dynamic split on purpose: it inserts two
  boundaries so ColorMasks becomes a dynamic chunk of its own, which keeps the partition sorted,
  non-overlapping and complete - so it still COMPILES - while making glColorMask bump
  m_pipelineStateVersion without moving the pipeline-subset hash. A non-zero ctest is the pass.
- Everything that could make that control lie is refused rather than reported: a missing
  SetterConsistency test exits 2 instead of reading "no tests matched" as a failure; a tree that
  is already red or already broken exits 2; a patched table that does not compile exits 2, since
  a build break would prove the static_asserts work rather than that the test still checks; and
  the restore is from byte-for-byte copies (never from git, so a dirty tree is given back
  intact), followed by a rebuild and a re-run that must be green. --verify-patch-only exercises
  the mechanism where the test does not exist yet and says explicitly that it is not a pass.
- Profiles for the two campaign devices, and the guard that stops them being trusted early. Both
  carry PROFILE_VERIFIED=0 and every device-specific field is TODO_VERIFY_ON_DEVICE rather than a
  guess: the harness pins through MediaTek nodes and 35d0befa is a Qualcomm part, where
  `su -c 'echo ... > /proc/ppm/...'` fails with a zero exit and the run would report numbers it
  believes were pinned. bench.sh and session.sh now refuse an unverified profile unless
  --allow-unverified-profile is passed, which warns that the run is not comparable with a pinned
  one. The README records what earns PROFILE_VERIFIED=1.

tools/device_bench/devices/oppo-mali.env

@@ -0,0 +1,48 @@
+# Device profile: Oppo / ColorOS, Mali GPU, adb serial 3B159D009VZ00000.
+#
+# The second of the two devices the disaggregation campaign is measured on (the other is
+# devices/xiaomi-adreno830.env). Same purpose: keep the pinning and thermal protocol in the
+# repository rather than in one operator's shell history.
+#
+# ============================ NOT YET DEVICE-VERIFIED ============================
+# PROFILE_VERIFIED=0, and bench.sh / session.sh / profile.sh refuse to run against it unless
+# --allow-unverified-profile is passed. This part is a MediaTek SoC, so unlike the Adreno
+# profile the harness's existing /proc/ppm + /proc/gpufreq pin path is probably the right one -
+# but "probably" is exactly the state a measurement profile must not ship in. The cluster
+# indices, the available OPPs, the top GPU OPP and the thermal zone TYPE all differ between
+# MediaTek generations, and odinlite.env's values are for an MT6877, not for this device.
+#
+# To promote it: read the four TODO fields off the device
+# (`cat /sys/devices/system/cpu/cpufreq/policy*/scaling_available_frequencies`,
+# `cat /proc/gpufreq/gpufreq_opp_dump`, `for tz in /sys/class/thermal/thermal_zone*; do
+# echo "$tz $(cat $tz/type)"; done`), run one pinned window, check big_cur/little_cur/gpu_cur_khz
+# in the result JSON against the pins, then set PROFILE_VERIFIED=1.
+#
+# ColorOS traps that belong with this device, and cost a run each when forgotten:
+#   * the first install of a not-yet-installed package blocks on
+#     com.oplus.appdetail InstallGuideActivity until "continue install" is tapped
+#     (`input tap 353 2349` on the 1272x2772 panel);
+#   * a foreign-signed APK has to be uninstalled before a rebuild will install;
+#   * pass MSYS_NO_PATHCONV=1 on every adb invocation from Git Bash, or a /data/... argument is
+#     rewritten into a Windows path.
+# =================================================================================
+PROFILE_VERIFIED=0
+PIN_STYLE=ppm
+
+DEVICE_SERIAL=3B159D009VZ00000
+
+# Campaign protocol constants (perf-test-protocol): big 1.96 GHz, little 1.55 GHz, GPU at its
+# top OPP, 40 C start gate. As above, the kHz values are the protocol's targets and the nearest
+# actual OPP has to be confirmed on the device.
+CPU_BIG_POLICY=TODO_VERIFY_ON_DEVICE
+CPU_BIG_FREQ=1958000
+CPU_LITTLE_POLICY=TODO_VERIFY_ON_DEVICE
+CPU_LITTLE_FREQ=1550000
+
+# MediaTek legacy gpufreq, same node family as odinlite. The top OPP is device-specific.
+GPU_PIN_KHZ=
+GPU_UTIL_NODE=/sys/kernel/ged/hal/gpu_utilization
+GPU_CURFREQ_NODE=/sys/kernel/ged/hal/current_freqency
+
+THERMAL_ZONE_TYPE=TODO_VERIFY_ON_DEVICE
+THERMAL_START_MAX_MC=40000

tools/device_bench/devices/xiaomi-adreno830.env

@@ -0,0 +1,54 @@
+# Device profile: Xiaomi, Snapdragon 8 Elite (Adreno 830), adb serial 35d0befa.
+#
+# One of the two devices the disaggregation campaign is measured on (the other is
+# devices/oppo-mali.env). It exists so that the pinning and thermal protocol the campaign
+# actually runs is written down in the repository instead of living in one operator's shell
+# history, and so that a `--device` argument names something reviewable.
+#
+# ============================ NOT YET DEVICE-VERIFIED ============================
+# PROFILE_VERIFIED=0 below, and bench.sh / session.sh / profile.sh REFUSE to run against a
+# profile that says so unless --allow-unverified-profile is passed. Two of the values here are
+# protocol constants that are known (the campaign pins big 1.96 GHz / little 1.55 GHz and gates
+# at 40 C), but the sysfs node names and the exact available OPPs are NOT: this is a Qualcomm
+# part and the harness was written against MediaTek, where the pin goes through
+# /proc/ppm/policy/hard_userlimit_* and the GPU through /proc/gpufreq/gpufreq_opp_freq. Neither
+# path exists on this SoC - Adreno pins through /sys/class/kgsl/kgsl-3d0/devfreq/{min,max}_freq
+# and its cpufreq policies are not policy6/policy0.
+#
+# A profile that quietly wrote MediaTek paths on this device would be the worst outcome
+# available: `su -c 'echo ... > /proc/ppm/...'` fails silently, bench.sh would report a run it
+# believes was pinned, and the pin-integrity fields it samples at window end would be the only
+# clue. So the unknown fields are left EMPTY and marked, rather than guessed, and the refusal is
+# the mechanism that keeps them from being used before somebody has read them off the device.
+#
+# To promote this profile: fill in the four TODO fields from the device
+# (`cat /sys/devices/system/cpu/cpufreq/policy*/scaling_available_frequencies`,
+# `ls /sys/class/kgsl/kgsl-3d0/devfreq/`, `for tz in /sys/class/thermal/thermal_zone*; do
+# echo "$tz $(cat $tz/type)"; done`), teach bench.sh the Qualcomm pin path, run one pinned
+# window, check big_cur/little_cur/gpu_cur_khz in the result JSON against the pins, and only
+# then set PROFILE_VERIFIED=1 in the same commit as the bench.sh change.
+# =================================================================================
+PROFILE_VERIFIED=0
+PIN_STYLE=qualcomm-kgsl
+
+DEVICE_SERIAL=35d0befa
+
+# Campaign protocol constants (perf-test-protocol): big 1.96 GHz, little 1.55 GHz, GPU at its
+# top OPP, and a 40 C start gate. The kHz values are the protocol's targets; the nearest actual
+# OPP has to be read off the device before they are used, because a cpufreq write that names a
+# frequency the policy does not offer is rounded silently.
+CPU_BIG_POLICY=TODO_VERIFY_ON_DEVICE
+CPU_BIG_FREQ=1958400
+CPU_LITTLE_POLICY=TODO_VERIFY_ON_DEVICE
+CPU_LITTLE_FREQ=1555200
+
+# Adreno pins through the kgsl devfreq knobs, not /proc/gpufreq. Left empty deliberately: see
+# the block above.
+GPU_PIN_KHZ=
+GPU_UTIL_NODE=/sys/class/kgsl/kgsl-3d0/gpubusy
+GPU_CURFREQ_NODE=/sys/class/kgsl/kgsl-3d0/gpuclk
+
+# Thermal gate: 40 C, the campaign's threshold. The zone TYPE differs per SoC and bench.sh
+# matches on it by name, so it has to be read off the device.
+THERMAL_ZONE_TYPE=TODO_VERIFY_ON_DEVICE
+THERMAL_START_MAX_MC=40000