[jcwal1516]

Add a regression guard for route-dependent output, error-class and allocation changes. It covers 1,444 cases across 22 generated images: full and region decodes, reduced resolution, bounded rows, 8-/16-bit and native output, serial and local-pool execution, and constrained planes budgets. Fixtures include offsets, edge tiles, multiple components, reversible and irreversible transforms, terminated classic passes, and HT packets split across layers and tile-parts.

The guard fails on output differences from the planes route, typed outcome changes, malformed or incomplete baselines, duplicate or missing cases, and release heap peaks above the accepted target baseline. The heap limit is the accepted peak plus its measured spread, 64 KiB and 1/64 of the accepted peak. Pool cases repeat five times, or twenty for large/noisy cases. Debug runs compare outcomes and case sets; heap comparisons require the same target and release profile.

ARM64 macOS and x86-64 Linux have separate baselines. Their headers explain the accepted per-worker scratch increases. Existing native multi-segment tests cover BYPASS/RESET routes and output separately; they do not supply heap-peak baselines.

This follows #317. It contains only the guard, its baselines and the test-only allocation-probe dependency. It changes no production API, #133 ring depths, error replay, band-release rule or serial executor. None of its changed files have prior jcoyne contributions in the reviewed upstream history.

Validation

• Fresh release runs on this head pass on ARM64 macOS and x86-64 Linux: all 1,444 cases match, and all four guard tests pass on each target.
• Policy tests cover malformed/duplicate baselines, case-set/outcome drift and the exact heap-limit boundary.
• Full cargo xtask test on this head passes on macOS: 5,656 passed, 0 failed, 52 ignored.
• The guard changes passed formatting, lint, API and focused tests during integration. Separate exact-head CUDA and Metal quick validation passed on this PR’s exact head.