spec(ml): train_slice_model -- a model spec that trains for real and writes its checkpoint to a file (own model cell 25) #10183

Part of epic #10024 ("our own model"), cell 25 "t27c --backend ml". Follows #10085 / PR #10165, which lowered the four host calls (host_open, host_read, host_write, host_close) and built the first model binary, specs/ml/host_io_model.t27.

Goal

Make t27c compile <spec> --backend ml lower a TRAINING model spec to a binary that actually trains and leaves its result in a real file. The model spec is pure t27 and reuses the existing training step in specs/nn/hslm_backward.t27 (forward, backward, straight-through gradient, clip, SGD, requantize on one 3-head slice) instead of copying it.

Boundary

• specs/ml/train_slice_model.t27 (new)
• docs/reports/t27b_expectations.json (one row for the new spec, only if the ratchet requires it)
• specs/nn/hslm_backward.t27: call sites only (10 calls to bare names so the step lowers under use), no change in logic; its 15 tests stay green
• Read only: specs/nn/ternary_ste.t27, specs/ml/file_io_contract.t27, specs/ml/host_io_model.t27
• Not touched: specs/igla/own_model.t27, specs/igla/own_model_board.t27, any Rust, any non-t27 file.

Scenarios

• Given the spec, When t27c test-report specs/ml/train_slice_model.t27 runs on the Railway lab, Then every test passes with 0 failed and 0 vacuous, including a negative test where 0 steps does not halve the loss.
• Given the spec, When t27c compile specs/ml/train_slice_model.t27 --backend ml is built and run, Then it exits 0, trains 20 steps, asserts the last loss is below half the first, and writes a checkpoint to /tmp/t27_train_slice.bin that it reads back byte for byte.
• Given /tmp/t27_train_slice.bin is a directory, When the binary runs, Then it aborts with a non-zero exit instead of reporting success.

Requirements

• FR-001: The training step MUST come from nn::hslm_backward through use; its logic MUST NOT be copied.
• FR-002: pub fn main() -> void MUST run N=20 steps on the fixed data of hslm_backward's tests and assert the final loss is below half of the first.
• FR-003: The checkpoint MUST carry the trained trits, the biases and the first and last loss, and MUST be written with host_open, host_write and host_close and read back with host_read.
• FR-004: No hand-written code in any language other than t27 is added or changed. If the backend cannot lower something needed, the work stops and the exact t27c error is reported here.

Success Criteria

• t27c test-report specs/ml/train_slice_model.t27 reports 5 tests, 0 FAIL, 0 vacuous passes on the Railway lab.
• The compiled binary exits 0 and writes 379 bytes to /tmp/t27_train_slice.bin.
• With /tmp/t27_train_slice.bin made a directory, the binary exits 134.

Close criteria

• t27c test-report specs/ml/train_slice_model.t27 on the Railway lab: all tests pass, 0 failed, 0 vacuous.
• The compiled binary exits 0; size and sha256 of /tmp/t27_train_slice.bin and the recorded first and last loss are posted in the PR.
• The directory-in-the-way control makes the binary exit non-zero.
• The t27b ratchet is green in the PR.