fix(cli): restore the read-ahead's invariant assertions

[lusoris]

Summary

The vmaf CLI's read-ahead (FrameReader, ADR-1366) checks its invariants with assert() again. #1785 had replaced all seven by early returns and folded conditions to remove a clang-tidy finding that is a false positive on the host it was measured on.

The defect

T-TIDY-CPU-LANE-ABOVE-BASELINE-2026-10-02 counted 7 cert-dcl03-c,misc-static-assert findings in core/tools/vmaf.cpp as regressions. They are not:

• glibc 2.44 expands assert(e) in C++ to ((e) ? void (1 ? 1 : bool (e)) : __assert_fail(...)), and clang-tidy 22.1.8 then reports the check for every runtime assert().
• A six-line file with assert(p != nullptr) on a pointer parameter gives 1 warning on the host (glibc 2.44) and 0 with the same check under glibc 2.43 (dev container). The required Tidy Ratchet context measures on ubuntu-24.04 (glibc 2.39), so the committed baseline was right.

The replacements changed what a broken invariant does:

Function	Before #1785	After #1785
publish()	asserts count_ < kReadaheadDepth	drops the frame
wait_for_free_slot()	asserts count_ <= kReadaheadDepth	returns false: the reader ends as if the stream were over
start()	asserts the reader is not started	returns without starting
next(), release_fetched_picture()	assert the pointer	return -EINVAL / nothing
request_stop()	asserts the count	bounds the drain loop

None of these states is reachable by construction, but an invariant that fails silently is worse than one that stops.

What changed

• core/tools/vmaf.cpp: the seven assert()s and <cassert> are back. The other four files of fix(lint): bring the cpu tidy lane back to its baseline #1785 keep their fixes.
• core/test/test_cli_frame_reader_asserts_contract.py (fast suite): fails when one of the seven is no longer an assertion.
• core/tools/AGENTS.md, docs/state.md, docs/rebase-notes.md, changelog fragment.

Verification

python3 core/test/test_cli_frame_reader_asserts_contract.py   # 3 tests OK; lists all seven on master 2096bd1bb
meson setup build-dbg core --buildtype=debug -Db_lto=false -Denable_cuda=false -Denable_sycl=false
ninja -C build-dbg
python3 scripts/ci/run_meson_test.py -- -C build-dbg --suite=fast   # 232 OK, 0 fail (assertions active)

The CLI on the Netflix 576x324 pair in that debug build exits 0 with 48 frames.

Not run: the clang-tidy cpu lane in the CI image. On this host it reports the seven false positives again by design; T-TIDY-GLIBC-244-STATIC-ASSERT-FALSE-POSITIVE-2026-10-02 records how to measure instead.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: restores removed assertions; the cause is recorded in the state rows
• Decision matrix — no alternatives: only-one-way fix (the assertions existed before fix(lint): bring the cpu tidy lane back to its baseline #1785)
• AGENTS.md invariant note — core/tools/AGENTS.md
• Reproducer / smoke-test command — python3 core/test/test_cli_frame_reader_asserts_contract.py
• CHANGELOG fragment — changelog.d/fixed/cli-frame-reader-asserts-restored.md
• Rebase note — docs/rebase-notes.md