Add Strix Halo/GFX1151 Support

[hstolte11-collab]

Summary

Adds an upstream-faithful Strix Halo / Radeon 8060S (gfx1151, RDNA 3.5) port without replacing Hyperloom's existing workflows.

• registers radeon8060s -> gfx1151 throughout GPU identity, runner selection, and bare-metal ROCm preflight
• preserves Claude while adding explicit native Codex OAuth and Hermes peer transports
• routes all providers through the original Quark prompt/skill/workspace/retry/validation contract
• adds Hermes to the existing Coordinator and Arbor specialist abstractions
• adds Hermes/native Codex support to KernelForge's existing backend registry
• adds source-backed gfx1151 KernelForge hardware knowledge cards
• handles modular ROCm roots, Python 3.14/Ray compatibility, ROCm platform discovery, and current HIP visibility semantics

No replacement planner, readiness controller, deterministic substitute workflow, or automatic production-promotion mechanism is introduced.

Writable Hermes transports fail closed unless Hyperloom verifies a concrete outer-container runtime marker; Codex uses its native workspace-write sandbox, and Coordinator Hermes runs without local terminal/file tools.

Physical qualification

Qualified on an AMD Radeon 8060S / Strix Halo APU reporting native gfx1151 under Torch 2.13.0+rocm10.0.0 / HIP 7.15.26333:

• original Coordinator through Hermes: 12 real turns with persisted state and PolicyGate enforcement
• original Arbor/EXPLORE: physical baseline 132.40 output tok/s; 3 specialists completed; enable-cudagraphs promoted to 137.72 output tok/s (+4.01%)
• original GEAK workflow: physical KNN correctness pass, 14 agent calls
• KernelForge forge-loop: physical candidate correctness pass (103.87 dB SNR), three timings, deterministic REVERT
• original Quark Codex and Hermes arms: W8A8 PTQ/export, 196 linear modules, 1,095 tensors, all four validators passed
• retained vLLM: 2/2 fixed 64 -> 16 requests; 131.03 output tok/s
• retained SGLang with Triton attention: 2/2 fixed 64 -> 16 requests; 82.19 output tok/s

Provider and model fallback were disabled for qualification. No production service, router, or registry was activated.

Local verification

• ruff check .
• ruff format --check .
• shell syntax check for the modified bare-metal installer
• 637 focused tests passed (635 directly plus 2 checkout-path-sensitive tests through the same source mounted at a neutral path)
• 332 directly affected provider/security/startup/specialist tests passed after final transport hardening
• real confined Hermes one-shot smoke returned the exact expected response
• staged public-data scan: no credentials, private host/IP/path data, or unsafe execution patterns

Mypy remains advisory and reports the repository's existing type-check backlog.

Known limits

• Current upstream AITER infrastructure can build/import several modules on gfx1151, but SGLang AITER attention is not qualified for the tested BF16 Qwen3 GQA2/head-size-128 geometry: CK prefill variants fail compilation and paged decode device-asserts. The qualified SGLang route uses explicit Triton attention.
• This PR establishes functional platform/workflow readiness; it does not automatically promote any candidate or mutate production serving.