eval_hslm.t27 BLOCKED after #10866: mirror the 31 b3_* speed=3 scratch arrays #10906

Boundary

• specs/ml/eval_hslm.t27 only: the module-level state block that mirrors specs/ml/train_hslm.t27 (names, types, initial values, nothing else). No kernel, no training path, no Rust changes.
• docs/reports/t27b_expectations.json only if the ledger row of ml/eval_hslm changes.
• Out of scope: train_hslm.t27 itself, and the threads work of feat(ml): thread primitive + train_hslm windows on N threads, bit-identical at any count (#10876) #10896 (this issue only keeps the mirror in step with it).

User Scenarios

• As the owner of the HSLM eval (own_model cell 25), I run the t27c test report on specs/ml/eval_hslm.t27 and every test runs, instead of the module being BLOCKED with use of undeclared identifier 'b3_q'.
• As a reviewer, I see that eval_hslm declares exactly the 31 b3_* scratch arrays that tr3_* in train_hslm uses, with train_hslm's own types and sizes.

Requirements

• R1: eval_hslm.t27 declares the 31 b3_* module-level arrays of train_hslm.t27 (speed=3 window scratch, added by spec(ml): train_hslm speed=3 -- one matrix over the 27 positions, bit-identical to speed=2 (Closes #10849) #10866 for train_hslm: speed=3 -- one matrix over the 27 positions, bit-identical to speed=2 #10849) with identical names, types and sizes. use_resolve splices no var, so a name reached through tr_window_forward -> tr3_forward must be declared in the using module.
• R2: no other line of the module changes; the evaluation numbers do not move (speed_level stays 2 in eval).
• R3: the seal of ml/eval_hslm is re-saved from the new text.

Success Criteria

• The t27c test report on specs/ml/eval_hslm.t27 on the Railway lab: all tests pass, 0 vacuous, no BLOCKED.
• The seal of specs/ml/eval_hslm.t27 is saved, and --verify exits 0.
• Required checks of the PR are green.