fix(hlo): SDPA explicit mask under GQA and onto a dynamic key length

[michalharakal]

Closes #1302.

What

AttentionOperationsConverter's explicit-mask path emitted invalid StableHLO:

• Per-head mask under GQA ([b, H, Sq, Sk], nKV < H): was broadcast_in_dim dims = [0, 1, 3, 4] onto [b, nKV, nRep, Sq, Sk], mapping H onto nKV. Now reshaped into [nKV, nRep] in the h = kv * nRep + r order Q uses (dynamic_reshape when a dim is dynamic). A mask head dim other than 1, nKV or H is rejected with a clear message.
• Mask onto a dynamic scores shape (the ? key length of KV-cache chunk graphs), with or without GQA: was a static broadcast_in_dim to a dynamic type. Now dynamic_broadcast_in_dim with the scores-shape operand the softmax already builds (hoisted so both share it), plus known_expanding_dimensions / known_nonexpanding_dimensions. IREE 3.11 needs those hints to lower it. Emitted in generic op syntax, since the hints are not in every StableHLO version's pretty form.

Static graphs emit exactly what they did before.

Verification

• Four new SdpaGqaHloExportTest cases fail on develop and pass here. :skainet-compile:skainet-compile-hlo:jvmTest passes 240/240.
• The emitted modules were compiled with iree-compile 3.11.0:

case	vulkan-spirv valhall4	llvm-cpu arm32
GQA, per-head mask, static	compiles	compiles
GQA, head-shared mask, dynamic key length	compiles	compiles
MHA, head-shared mask, dynamic key length	compiles	compiles
GQA, per-head mask, dynamic key length	valid StableHLO, IREE 3.11 does not lower dynamic_reshape	same

The last row is an IREE limitation. It is noted in the CHANGELOG with the recommendation to use a head-shared mask when the key length is dynamic.

[michalharakal]

Compatibility check

skainet-iree-conformance. I ran scripts/run-conformance.sh with USE_SKAINET_SOURCE=1 and core built from this branch (4e586b24). skainet-compile-hlo resolved to the source project. The only change in the throwaway worktree was the Gradle wrapper, bumped to 9.7.1 because core needs 9.6 or newer.

• 12/12 models pass export, compile, run and validate on IREE 3.11.0 llvm-cpu. That includes tiny-transformer (both oracles), rope-attention and gemma-decoder, the multi-query model with 2 query heads and 1 K/V head.
• 33/33 ops compile, run and validate, including sdpa.
• The gate passes.

Byte-identical output for every SDPA shape the suite uses. The converter emits the same bytes on develop and on this branch for these configurations:

config	q	k/v	mask
ops/sdpa	[1,2,4,8]	[1,2,4,8]	[1,2,4,4]
functiongemma-270m scaffold	[1,1,4,64]	[1,1,4,64]	[1,1,4,4], causal
gemma-decoder, causal path	[1,2,4,32]	[1,1,4,32]	none
gemma-decoder, sliding-mask path	[1,2,4,32]	[1,1,4,32]	[1,1,4,4]
tiny-transformer / rope-attention	[1,2,4,4]	[1,2,4,4]	none, causal

Existing dynamic-shape conventions are unaffected. Downstream KV-cache exports already rely on the dynamic-safe tracer and emitter from 0.38 (#891). The ones with a dynamic key length avoid this bug in one of two ways:

• The chunk mask is exactly the scores shape, with K/V expanded to the query heads. The converter adds it directly, and this PR keeps that maskShape == scoresShape branch unchanged.
• The masked attention is static, and only the unmasked self-attention of the decode step is dynamic.

This PR changes only the two cases that were invalid IR before: a per-head mask under GQA, and a mask that differs from a dynamic scores shape.