kernels: build the denoiser's output kernel natively, authorized separately

Ray Reconstruction's eleven DLSS-D Swin layers still run ZLUDA's compile of
NVIDIA's PTX; at 1280x720 -> 3840x2160 on gfx1201 they are 30.2 of a 31.6 ms
frame. The denoiser's high-fidelity output kernel is the first one with a native
replacement: make_ptx.py replaces its whole-texel RGBA16F store
(sust.b.2d.v4.b16.zero) through d4r_sust_v4b16, kernels/build.sh builds the pair
as the `rr` family, and packaging builds it into every target folder including
the RDNA4 FP8 ones.

Both libraries define modules named cuda_dldn_engine_*, with different text, so
one manifest cannot take the union of their hashes: kernel_manifest.py now takes
the denoiser DLL as --rr-dll and lets only its hashes authorize a
cuda_dldn_engine_* binary, and package_release.sh passes it when the denoiser is
bundled.

Verified in the D3D12 harness with Ray Reconstruction at 1280x720 -> 3840x2160:
the output kernel drops from 1.44 to 1.00 ms/frame and the 66 MB raw output is
byte-identical to the run with every kernel translated.

docs/native-kernels.md gains the denoiser family, the per-kernel cost table and
the instruction counts that show why the Swin layers are the remaining work.

tests/test_kernel_manifest.py

@@ -0,0 +1,62 @@
+"""Native SR code must never be authorized by a colliding denoiser entry."""
+import importlib.util
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+TOOLS = ROOT / 'kernels/tools'
+sys.path.insert(0, str(TOOLS))
+spec = importlib.util.spec_from_file_location('d4r_kernel_manifest', TOOLS / 'kernel_manifest.py')
+manifest = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(manifest)
+
+
+def fatbin(ptx):
+    entry = bytearray(64)
+    struct.pack_into('<HHIQ', entry, 0, 1, 0, 64, len(ptx))
+    payload = entry + ptx
+    return struct.pack('<IHHQ', 0xBA55ED50, 1, 16, len(payload)) + payload
+
+
+class KernelManifestTests(unittest.TestCase):
+    def test_denoiser_owned_name_comes_only_from_the_denoiser_dll(self):
+        # A cuda_dldn_engine_* kernel may only be authorized by the DLL passed as --rr-dll; the
+        # Super Resolution libraries define names of that shape too, and their modules differ.
+        sr = b'.visible .entry dl4rt_input_kernel() { ret; }\n'
+        rr = (b'.visible .entry dl4rt_input_kernel() { mov.u32 %r1, 1; ret; }\n'
+              b'.visible .entry cuda_dldn_engine_swin_enc1_kernel() { ret; }\n')
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / 'sr.dll').write_bytes(fatbin(sr))
+            (root / 'rr.dll').write_bytes(fatbin(rr))
+            for name in ('dl4rt_input_kernel', 'cuda_dldn_engine_swin_enc1_kernel'):
+                (root / (name + '.hsaco')).touch()
+            subprocess.run([sys.executable, str(TOOLS / 'kernel_manifest.py'), str(root),
+                            str(root / 'sr.dll'), '--rr-dll', str(root / 'rr.dll')],
+                           check=True, capture_output=True)
+            rows = [line.split() for line in (root / 'd4r-kernels.txt').read_text().splitlines()
+                    if line and not line.startswith('#')]
+            self.assertEqual(rows, [
+                ['cuda_dldn_engine_swin_enc1_kernel', f'{manifest.fnv1a64(rr):016x}'],
+                ['dl4rt_input_kernel', f'{manifest.fnv1a64(sr):016x}'],
+            ])
+
+    def test_rr_only_input_refuses_unproven_sr_binary(self):
+        rr = b'.visible .entry dl4rt_input_kernel() { ret; }\n'
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / 'rr.dll').write_bytes(fatbin(rr))
+            (root / 'dl4rt_input_kernel.hsaco').touch()
+            result = subprocess.run([sys.executable, str(TOOLS / 'kernel_manifest.py'), str(root),
+                                     '--rr-dll', str(root / 'rr.dll')], capture_output=True, text=True)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn('no DLL defines dl4rt_input_kernel', result.stderr)
+            self.assertFalse((root / 'd4r-kernels.txt').exists())
+
+
+if __name__ == '__main__':
+    unittest.main()