V3: BlueField feature path + production hardening (hardware NOT_RUN)

[loverustfs]

Summary

V3 slice on top of V1 A/B/C and the V2 first slice. The default build stays CPU/TCP and does not link DOCA, SPDK, libnixl, or a DPU. BlueField-3, GDS, and DOCA stay in development / NOT_RUN_HARDWARE / optional feature. Nothing here is a measured TTFT, TCO, or PB-scale result, and nothing is marked production-ready.

The single offload candidate is the storage queue (DRAM slab + NVMe submit/complete) on a storage-side BlueField-3, with the GPU client keeping an ordinary ConnectX. That choice is a hypothesis pending a paired NIC-RDMA vs DPU run. See docs/adr/0006-storage-queue-offload.md.

What landed

• gpucache-dpu: empty feature dpu-bf3. open_doca / open_spdk / open_nvme_device refuse in every build. ArmAgent::start does not set offload_active. Simulated submit/complete round-trips bytes and labels the completion NOT_RUN_HARDWARE. AffineQueue rejects a mismatched reactor id and does not start SPDK or Tokio. Planned DPU mode, BFB, OS, DOCA, firmware, and IOMMU rows are unset targets (docs/V3_DPU_TARGETS.md). Host GPUNetIO NIC-mode is explicitly not this daemon.
• Ablation knobs for P2P, DPA, compression, and crypto. Enabling one prints NOT_RUN_HARDWARE and does not change bytes. Hot-tier erasure coding cannot be enabled (ADR 0002).
• CPU hardening: ACL (read is not write), bounded replay window, SHA-256 integrity seal (not an HMAC), per-tenant rate limit / noisy-neighbor test, secret rotation with audit events that omit fingerprints. mTLS is not linked; the boundary is a trusted fabric (ADR 0007). The TCP server does not call the new ACL yet.
• ControlPlane: rebalance, rolling upgrade/rollback, and fault-domain isolation. These fence in-flight fills and do not copy payloads.
• Degrade hooks: DPU restart, GPU reset, NIC flap, storage loss, NVMe timeout, control-plane loss, RustFS slow/unavailable. Each decision is a clean miss, with no payload and no permanent block (docs/V3_FAILURES.md).
• G4: retention, manifest version rejection, async reclaim with delete verification, tenant cold-key lifecycle, backfill byte budget. Live RustFS stays env-gated NOT_RUN_HARDWARE.
• v3-paired requires a NIC-RDMA baseline vs DPU and prints NOT_RUN_HARDWARE, TCO_UNKNOWN, and go_gate=NOT_EVALUATED. TCP is forbidden as that baseline. The report contains no digits.
• SGLang/HiCache is an evaluation note only (ADR 0008). No second engine was added.
• Ops notes: diagnostics via dpu-demo, capacity, upgrade/rollback, compatibility matrix, minimal loopback deploy example. DOCA license review is flagged NOT_RUN_LICENSE without a legal conclusion (THIRD_PARTY_NOTICES.md).

Explicitly not claimed

• No BF3 purchase, no firmware/IOMMU/NVMe format, no DOCA performance numbers.
• No vLLM or NIXL measurement. aarch64 CI remains a CPU build.
• No sync EC and no durability replicas on the hot tier.
• Go gate (cost per million output tokens, or an isolation goal) is not evaluated. A no-go would keep the portable TCP/file backends.

Test plan

cargo fmt --all -- --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace --all-targets
cargo test -p gpucache-dpu --all-targets --features dpu-bf3
cargo run -p gpucache-dpu --bin dpu-demo
cargo run -p gpucache-bench --bin v3-paired

Local result before this PR: default cargo test --workspace --all-targets passed, dpu-bf3 passed and still refused device open, dpu-demo printed offload_active=false and hardware=NOT_RUN_HARDWARE, v3-paired printed TCO_UNKNOWN.