test(model): cover a failed model-collection growth

[lusoris]

Summary

This adds the regression test that the fork was missing for the fix of our upstream Netflix/vmaf PR #1590. No library code changes.

vmaf_model_collection_append() doubles its model array when the eighth slot is taken. Upstream takes its common failure label when that realloc() fails and clears the caller's handle, which loses the collection and its models. The fork already returns -ENOMEM directly and leaves the collection untouched (core/src/model.c), but no test called vmaf_model_collection_append() at all, so a rebase onto upstream's version would have gone unnoticed.

test_model_collection_growth links with -Wl,--wrap=realloc, fails the one realloc() of the model array, and checks three cases on real models loaded from model/vmaf_v0.6.1.json:

• eight models fill the initial array without growing it;
• the ninth doubles it once and keeps every member;
• a failed growth returns -ENOMEM, leaves handle, array, count, capacity and members unchanged, and the rejected model can be appended on retry.

Type

• feat — new feature
• fix — bug fix
• perf — performance improvement
• refactor — no behavior change
• docs — documentation only
• test — test-only
• build / ci — tooling / infra
• port — cherry-pick from upstream Netflix/vmaf
• sycl / cuda / simd — backend-specific

Checklist

• Commits follow Conventional Commits (the commit-msg hook enforces this).
• make format && make lint is green locally. Not run in full. Run instead: clang-format --dry-run -Werror on the new file (clean), scripts/ci/tidy-ratchet.py --lane cpu --only core/test/test_model_collection_growth.c (0 warnings in the file), and the pre-commit hook set (passed).
• Unit tests pass: fast suite on a CPU build, 191 passed, 0 failed, 2 skipped, and on a CUDA build (gcc, nvcc, RTX 4090), 249 passed, 0 failed, 1 skipped; the new test also passes under ASan + UBSan + LeakSanitizer.
• If I touched any SIMD/GPU code path, I ran /cross-backend-diff and the worst ULP is ≤ 2. None touched.
• If I touched a feature extractor with SIMD/GPU twins, I either updated every twin or listed the gap under "Known follow-ups" below. None touched.
• If I added a new .c / .cpp / .cu / .h / .hpp, it has the appropriate license header (see CONTRIBUTING.md).
• If this is a breaking change, the commit message uses ! or BREAKING CHANGE: and the migration path is documented below.
• If this PR adds an ADR, the ADR row lives in docs/adr/_index_fragments/<NNNN-slug>.md and the slug is appended to docs/adr/_index_fragments/_order.txt.

Bug-status hygiene (ADR-0165)

• docs/state.md updated: T-MODEL-COLLECTION-GROWTH-FAILURE-UNTESTED-2026-10-01 under Recently closed.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.
• If I believe a golden value must change, I have explained why below AND pinged @lusoris for a CODEOWNERS exception.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: test-only change.
• Decision matrix — no alternatives: only-one-way fix already in tree; the test uses the link-time --wrap control the neighbouring ownership tests use.
• AGENTS.md invariant note — no rebase-sensitive invariants beyond the rebase note below.
• Reproducer / smoke-test command — pasted below under "Reproducer".
• CHANGELOG fragment — changelog.d/changed/test-model-collection-growth-failure.md.
• Rebase note — entry added to docs/rebase-notes.md.

Reproducer

CC=gcc meson setup build-san core -Db_lto=false -Denable_cuda=false -Denable_sycl=false \
  -Denable_float=true -Db_sanitize=address,undefined -Dbuildtype=debugoptimized
ninja -C build-san test/test_model_collection_growth
ASAN_OPTIONS=detect_leaks=1:halt_on_error=1 UBSAN_OPTIONS=halt_on_error=1 \
  build-san/test/test_model_collection_growth
# 3 tests run, 3 passed

Negative control, run locally and not committed: with upstream's *model_collection = NULL put back into the growth branch of vmaf_model_collection_append(), the third case fails with a failed growth lost or changed the existing collection.

Known follow-ups

None. The test is built on Linux with the static archive and without LTO only, because --wrap needs the linker to see the library's reference to realloc; test_registration_partial_copy has the same constraint.