perf(jpeg-metal): reuse subsampled single-image scratch

[jcwal1516]

Repeated synchronous JPEG Metal calls previously allocated decode planes, packet staging, and statuses on every image. Public fast 420/422 Surface paths now reuse those temporaries from the existing two-slot runtime pool. Returned Gray planes and packed RGB/RGBA buffers remain fresh, so later calls cannot overwrite retained surfaces.

The scratch lease takes ownership under short mutex holds and returns the scratch after completion and status checks. No pool mutex remains locked through GPU work. The existing backpressure and panic-poison behavior are preserved. Status ranges are zeroed, entropy/restart/checkpoint prefixes are fully restaged, and checkpoint conversion keeps the original checked direct-write path without a temporary host vector. Full and partial subsampled paths retain the lease through their final pack command.

Depends on draft #103, the committed identical-harness baseline at 070ef295. No shader math, public API, routing, dependency, or immutable cross-call packet cache change. Private resident-tile APIs remain on their existing allocation paths because the returned objects retain status/command/output resources. Queued region/scaled item encoders pass no single-call scratch, preserving independent resources within a command buffer.

Validation: the mutex test first failed because a lease held its slot mutex; the warm-allocation test first failed with 2 private buffers versus 0 expected. The owned pool passed eight focused real-Metal/pure pool tests. Nine focused single-path tests passed, including retained output across different images/sizes/sampling/formats, partial-operation alternation, simultaneous calls, device-entropy failure then reuse, and ownership through status read. At final candidate 56aea946, cargo run --locked -p xtask -- release-metal --mode quick passed production and non-library Clippy, all seven runtime/integration groups, the ignored-test inventory, and all 21 required ignored hardware tests. The JPEG Metal library reported 252 passed and 2 ignored. The optional external Aperio fixture remains unavailable. Formatting/diff checks passed. Earlier Clippy-only failures were fixed before this gate.

Allocation result: warm subsampled full-image calls across 420, restart 420, and 422 fixtures and Gray/RGB/RGBA allocate 0 private plus 1 shared buffer—the fresh returned output—versus 2 private/5 shared for Gray and 3 private/5 shared for RGB/RGBA before reuse. These counts exclude runtime setup and download. The tradeoff is retaining each slot's maximum-capacity temporary buffers until its session is dropped; the existing two-slot bound remains.

Rejected substage: 4:4:4 scratch reuse was tested and removed. A fresh confirmation against the same baseline found RGB 9.64% slower, RGBA 8.69% slower, and region-scaled 5.42% slower, with all mean-change confidence intervals above the 2% regression threshold. The final 4:4:4 implementation matches the baseline exactly; its correctness and fresh-allocation control tests remain. Failed candidate c4feebd9, both timing pairs, and raw samples are retained for review.

Latency at 56aea946 versus 070ef295, identical harness/profile/fixtures on Apple M4 Pro:

Route	Time reduction	Speedup
420 nonrestart full Gray/RGB/RGBA	5.58–6.45%	1.059–1.069×
420 restart full Gray/RGB/RGBA	2.10–4.06%	1.021–1.042×
422 full Gray/RGB/RGBA	8.77–9.31%	1.096–1.103×
420 restart quarter-scale	2.54%	1.026×
Distinct four-image batch control	0.11% slower	0.999×

The final 15-case pair confirms the subsampled gains. Restored 444 full medians were within 0.6% of baseline; two noisy controls were repeated with a fresh baseline. Their repeated medians were 0.03% slower (full RGB) and 0.41% slower (region-scaled). Mean-change 95% intervals remained broad at [−0.41%, +6.16%] and [−0.48%, +2.68%], so tail neutrality is not established. The large pooled-444 regressions did not persist after rollback; no reproducible >2% control regression remains. All first, confirmation, and final measurements are retained, including these noisy tails. Baseline includes 15 rows, 50 samples, 3-second warmup, 10-second requested measurement, release-bench on Apple M4 Pro. Confirmed relevant regressions above 2% reject the candidate.

Known baseline gap: generated 420 restart region-scaled output differs from native at 545/6912 bytes (maximum 39). That numerical issue predates this patch and is preserved/reported; the region-scaled performance control uses exact-parity 444. Private/shared reusable output and submitted-drop regressions passed in the broader local Metal gate. Exact-head manual GitHub Metal validation remains a premerge gate. CUDA validation is deferred until the end at the user's request.