fix(test): drop the second MALLOC_PERTURB_ entry and state row that #2548 landed twice

[lusoris]

Summary

reverts: #2548 (partially: drop duplicate MALLOC_PERTURB_ entry and state row)
intentional revert: drop the duplicate MALLOC_PERTURB_ entry and state row from #2548

#2548 landed the merge train's squash of its first revision (43298360b, built before the rework c0a0a61ed). That revision still carried its own MALLOC_PERTURB_=0 entry for test_gpu_picture_pool_uaf and a state row for the same bug, both of which #2547 had already landed. Master therefore lists the env entry twice and the bug twice.

• core/test/meson.build: the entry is listed once (fix(test): run the GPU pool UAF test without MALLOC_PERTURB_ so it cannot fill the host's memory #2547's).
• docs/state.md: T-TEST-GPU-POOL-UAF-PERTURB-OVERCOMMIT-2026-10-08 is removed; T-GPU-POOL-UAF-TEST-FILLS-HOST-MEMORY-2026-10-08 stays.
• The fix(ci): pin the API generator's format test to the hook's clang-format and check model JSON out with LF #2548 changelog and rebase-note fragments no longer claim the UAF fix.

The merge train now re-reads every PR head right before it pushes a batch and drops a PR whose head moved while it was gated (local tooling, not in this repository).

Type

• fix — bug fix

Checklist

• Commits follow Conventional Commits; signed off.
• check-state-md-rows.sh OK, make docs-fragments-check OK, commit hooks passed.
• Unit tests: no behaviour change (the duplicate entry set the same value).
• SIMD/GPU / twins: not touched.

Bug-status hygiene

• docs/state.md updated: the duplicate row of the same closed bug is removed.

Netflix golden-data gate

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables

• Research digest — no digest needed: trivial.
• Decision matrix — no alternatives: only-one-way fix.
• AGENTS.md invariant note — no rebase-sensitive invariants.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — no changelog needed: it only edits an existing fragment to drop a duplicate claim.
• Rebase note — no rebase impact: it removes a duplicate line from an existing fragment.

Reproducer

grep -c "'MALLOC_PERTURB_=0'" core/test/meson.build   # 1
grep -c 'T-TEST-GPU-POOL-UAF-PERTURB-OVERCOMMIT' docs/state.md   # 0
bash scripts/ci/check-state-md-rows.sh