fix(ci): repair two master-CI reds — orphaned Metal registry entries + MCP smoke path allowlist

[lusoris]

What

Two independent failures keeping CI red on every open PR. Both root-caused to
registry/contract drift introduced by earlier merged PRs, both verified locally.

1. Metal registry orphan

Re-registers the nine round-3/round-4 Metal feature extractors that were silently
dropped from the compiled registry, restoring the 17/17 contract asserted by
test_metal_kernel_coverage_audit (ADR-0959).

Why

PR #875 split core/src/feature/feature_extractor.c into .cpp but carried over
only 8 of the 17 *_metal externs. PR #1004 then deleted the now-dead .c
twin — which is where the other 9 lived. The .mm kernel TUs, the
g_metal_features[] dispatch rows and the parity tests all stayed in place, so
nothing failed to build; only the registry entries vanished. Net effect on macOS
Metal builds: vmaf_get_feature_extractor_by_name("<name>_metal") returned NULL
and --feature <name> could not select these kernels at all.

Affected: integer_ssim_metal, float_vif_metal, float_adm_metal,
integer_vif_metal, integer_adm_metal, integer_ciede_metal,
integer_psnr_hvs_metal, integer_cambi_metal, ssimulacra2_metal.

This is the same registry-split orphan class PR #1004 fixed for the GPU SpEED
twins, and it is the single failing test on both macOS CI build legs
(131 OK / 1 FAIL).

All additions sit inside #if HAVE_METAL; non-Metal builds are byte-unaffected.

---

2. MCP Smoke — compute_vmaf 10-bit case rejected by its own path allowlist

test_mcp_smoke's 10-bit case writes yuv420p10le fixtures to /tmp at run
time. PR #1054 added validate_path() to core/src/mcp/compute_vmaf.c, which
canonicalises every caller-supplied YUV path and admits only <repo>/testdata,
<repo>/model, <repo>/python/test/resource, /workspace/python/test/resource
and $VMAF_MCP_ALLOW. /tmp is deliberately not a default root, so
score_yuv_pair() returned -EACCES, the response carried no score field, and
the assertion tripped. This was the single failing test in the
MCP Smoke (Embedded C + Python Server) job.

Fixed in the test, not the allowlist: the case extends the allow-set via the
documented VMAF_MCP_ALLOW escape hatch for its own duration and unsetenv()s
it afterwards, so the remaining cases still run against the default roots. The
allowlist is unchanged and its rejection behaviour stays covered by
core/test/test_mcp_compute_vmaf_allowlist.c.

Reproduced and verified locally with the exact CI meson configuration:

cd core
meson setup build-mcp -Denable_cuda=false -Denable_sycl=false \
  -Denable_mcp=true -Denable_mcp_sse=enabled \
  -Denable_mcp_uds=true -Denable_mcp_stdio=true --buildtype=release
meson compile -C build-mcp
meson test -C build-mcp test_mcp_smoke --print-errorlogs
# before: 17 tests run, 1 failed  ("compute_vmaf 10-bit returns score")
# after:  18 tests run, 18 passed

Deep-dive deliverables

• Research digest — no digest needed: single-cause registry-orphan regression, root cause fully determined by diffing PR fix: iter10 bundle — 8 fixes (SYCL ADM, pool condvar, UBSan/ASan, Y4M fuzz, TSan/OrtEnv, vmaf-tune, AI scripts, MCP batch) #875 and PR fix(registry): restore orphaned GPU SpEED registrations + delete dead feature_extractor.c #1004 against the audit's expectation list.
• Decision matrix — no alternatives: restoring the nine lost externs and list entries is the only way to satisfy the 17/17 audit contract without deleting shipped kernels.
• AGENTS.md invariant note — no rebase-sensitive invariants: the Metal registry is fork-local and has no upstream Netflix counterpart.
• Reproducer / smoke-test command — see below.
• CHANGELOG fragment — changelog.d/fixed/metal-registry-orphan.md
• Rebase note — no rebase impact: fork-local Metal backend, absent upstream.

Reproducer / smoke-test command

Registry parity (any platform, no Metal device needed):

grep -oE '&vmaf_fex_\w+_metal' core/src/feature/feature_extractor.cpp | sort -u | wc -l
# 17 after this PR (8 before); EXPECTED_KERNEL_COUNT in
# core/test/test_metal_kernel_coverage_audit.c:108 is 17

The failing gate itself (macOS):

meson setup build -Denable_metal=true && \
  meson test -C build test_metal_kernel_coverage_audit --print-errorlogs

Audit #1 (test_every_kernel_basename_is_registered) is CPU-side and needs no
Metal device; audits #2/#3 skip with -ENODEV off-device.

Bug status hygiene

• docs/state.md updated — T-METAL-REGISTRY-ORPHAN-2026-08-30 added under Recently closed.

[lusoris]

Superseded by a rebuilt branch — the original had an orphan-root history that made rebase report both-added conflicts on files it never touched. Same two fixes, clean base.