docs(state): reconcile the fork's open Netflix/vmaf pull requests #1631 to #1668

[lusoris]

Summary

Extends the upstream reconciliation in docs/state.md from #1629 to the fork's remaining open Netflix/vmaf pull requests #1631 to #1668: 25 rows under "Confirmed not-affected", each naming the fork file, test or ADR that shows the fix is already carried, covered another way, or not applicable. #1634 (clip the integer AIM score) is recorded as closed on the maintainer's decision, because the fork keeps integer AIM unclipped (ADR-1417). Documentation only.

Type

• docs — documentation only

Checklist

• Commits follow Conventional Commits (the commit-msg hook enforces this).
• make format && make lint is green locally. (Only docs/state.md, CHANGELOG.md and a changelog fragment changed; the commit hooks ran green with the repo's pinned praetorctl build, PRAETOR_REF 04cc813f.)
• Unit tests pass: no code changed.
• If I touched any SIMD/GPU code path, I ran /cross-backend-diff: no SIMD or GPU code touched.
• If I added a new source file, it has the licence header: none added.
• If this PR adds an ADR: it adds none.

Bug-status hygiene (ADR-0165)

• docs/state.md updated in this PR with rows under "Confirmed not-affected" and one _Updated: line.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: ledger update, no new analysis.
• Decision matrix — no alternatives: only-one-way fix; records existing decisions (ADR-1417 and others) and adds none.
• AGENTS.md invariant note — no rebase-sensitive invariants.
• Reproducer / smoke-test command — pasted below under "Reproducer".
• CHANGELOG fragment — changelog.d/changed/state-upstream-reconcile-1631-1668.md, rendered into CHANGELOG.md with scripts/release/concat-changelog-fragments.sh --write.
• Rebase note — no rebase impact: documentation only.

Reproducer

git diff origin/master -- docs/state.md | grep -c '^+| \*\*Netflix/vmaf#'   # 25
scripts/release/concat-changelog-fragments.sh --check

Known follow-ups

• fix(speed): size speed_temporal and speed_chroma frame buffers correctly #1643 stays as a test-only gap: core/test/test_predict.c has the same bare expression as upstream; no fix here.
• The rows for fix(security): resolve CodeQL include alert #1309 and Scorecard SAST alert #6 (ADR-1389) #1659, fix(cuda): reproduce the CPU's running float sum in psnr_hvs_cuda #1666, perf(sycl): make cambi_sycl launch_reset scratch-free on Intel GPUs #1667, chore(interop): re-vendor the Pelorus mirror to 174938e (UTF-8 paths, owner-only fixture) #1640 and fix(cli): release option dictionaries on every early exit #1647 to fix(sycl): accept bare native images in AOT image check #1651 were read from source and from the fork's own measured records (ADR-1416, ADR-1194), not re-measured; each row says so.