Snapshot: fog implementation + fidelity tooling baseline (pre bilinear-clamp fix)

Per-vertex GS fog end-to-end (gs_stub emit incl. persp_emit5, gs_prim_list_feeder
XYZ2->XYZF2 on PRIM.FGE, gs_make_sh3_scheduler_fixture.py F/FGE packing), new fog
TBs, fidelity attribution tooling. Functional baseline before removing the dead
bilinear lerp8 clamps (Codex: 161-node comb loop -> -0.042ns setup fail).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/ch421_request_packet_boundary_prefit.md

@@ -0,0 +1,70 @@
+# Ch421 — complete request-packet boundary (prefit)
+
+## Trigger
+
+Ch420 successfully removed the direct request-pointer-to-RAM-address family.
+Its fit exposed ten paths from the wide request RAM's registered data output,
+through scene-bit decode, into separate fragment/marker valid registers.  The
+worst was `-0.273 ns`; no address-stage path appeared in the violated top ten.
+
+## Structural cut
+
+`gs_lpddr_zc_emit` now captures all `PW` request bits, including the scene bit,
+into one `req_stage_packet` register.  A single `req_stage_valid` occupancy bit
+is driven only by the already-registered `req_read_pending` control.
+
+Fragment versus marker selection is decoded after that complete packet
+boundary:
+
+```
+req_stage_frag_valid   = req_stage_valid && !req_stage_packet.scene
+req_stage_marker_valid = req_stage_valid &&  req_stage_packet.scene
+```
+
+Therefore no request RAM output bit feeds stage occupancy or two competing
+valid-register D cones.  The packet register intentionally has no reset;
+`req_stage_valid=0` makes it unobservable until a complete read is captured.
+Pop, pending, consume, marker ordering, and external latency are unchanged.
+
+## Prefit verification
+
+- async FIFO randomized CDC test: 3,284 writes/reads exact;
+- Z/color emit: 1,500 fragments exact across three epochs;
+- concurrent scanout/reload/probe: 16,384 pixels exact;
+- full 283-epoch production-control replay: PASS;
+- 1,177,489 fragments fed, 984,845 passed Z, zero drops/errors;
+- final Z mismatch `0 / 307,200`, color mismatch `0 / 235,963`;
+- framebuffer SHA-256 remains exactly
+  `a88f1f6c926dd0db2b72ae2873c399e7dc5666f8003190184c34d360b13a5f44`;
+- relevant `git diff --check`: PASS.
+
+## Owner fit gate
+
+Ready for one owner-controlled Quartus 26.1 GUI compile.  Acceptance requires:
+
+- no request RAM output path to stage occupancy/fragment/marker valid state;
+- any RAM-output-to-`req_stage_packet` data path is timing-clean;
+- setup, hold, recovery, removal, and minimum pulse all close;
+- request FIFO RAM inference remains intact at the existing device budget.
+
+Do not deploy the Ch420 RBF.  If Ch421 closes, deploy that RBF and execute the
+already-verified 283-epoch board scene before accepting the chapter.
+
+## Owner fit result — request path closed, design path exposed
+
+The owner-controlled Quartus 26.1 GUI fit completed successfully.  Ch421 did
+close the intended 310 MHz EMIF/request family:
+
+- EMIF setup WNS `+0.155 ns`, TNS `0`;
+- EMIF hold slack `0.000 ns` and all other timing classes clean;
+- no request FIFO path appeared in the violated setup paths;
+- 38,332 ALMs (82%), 55,712 registers, 336/358 RAM blocks (94%), 160 DSPs.
+
+The fit is nevertheless **not deployable** because placement exposed a separate
+25 MHz design-clock failure: setup WNS `-1.993 ns`, TNS `-14.856 ns`.  All ten
+reported paths launch at `u_tex|g_bilinear.tap[0][8/9]` and terminate at
+`raster_pixel_color_q[16/18]`.  The worst path contains 30 logic levels and
+41.955 ns of data delay: both bilinear interpolation stages plus TEX0 vertex
+modulation were being evaluated in one cycle.  That is an independent, real
+combinational boundary defect, not a reason to undo the now-clean request
+packet cut.  Ch422 addresses it structurally.