HSLM backward host glue in .t27: Trit-to-2-bit pack, padding, scales and K-limit refusal, with tests #10933

hslm_dx_s8 and hslm_dw_s8 (#10855) take ternary W as 2-bit codes packed 16 per u32, int8 activations padded to multiples of 16, and per-row / per-column scales. The trainer (specs/ml/train_hslm.t27) holds W as Trit values and activations as f64. This issue writes the host-side glue as pure .t27 functions with tests, in a new spec, so a later PR can call the GPU path from the trainer. It does not touch the trainer.

Refs #10847. Out of bounds (do not edit): specs/ml/train_hslm.t27, specs/igla/coder/hslm_bwd_ptx.t27, any Rust source under bootstrap/src.

Boundary

• specs/igla/coder/hslm_bwd_host.t27
• bootstrap/gen/rust/igla/coder/hslm_bwd_host.rs
• .trinity/seals/coder_igla-coder-hslm-bwd-host.json

User Scenarios

• Given a Trit matrix W in ternary_matmul_t_add's layout (code at j*K + i), when the pack function runs, then the u32 words equal the codes the dX kernel decodes (hand cases, 243 and 729 widths included).
• Given an activation matrix of 27 or 1782 rows and 243 or 729 columns, when the pad and quantise functions run, then the shapes are 256 or 736 wide, the padding is zero, and the scales match the formulas in hslm_bwd_ptx.t27.
• Given the output of the integer reference, when the dequantise function applies the stated scales, then the result is within the stated bound of the f64 backward.

Requirements

• FR-001: The spec MUST give pack (Trit to 2-bit, 16 per u32), pad (to a multiple of 16, zero fill) and dequantise (apply s_r for dX, sx_i * sy_j for dW) as pure functions.
• FR-002: Pack MUST be the inverse of the decode in hslm_bwd_ptx.t27; a round-trip test over a stated sample of words MUST pass.
• FR-003: The K limits (dX 16777215, dW 131071) MUST be checked by a function that refuses a shape beyond them, with a test for each side of the limit.
• FR-004: Constants and helpers MUST be reused from specs/igla/coder/hslm_bwd_ptx.t27 by use, not copied.
• FR-005: ASCII-only, a test or invariant per function, no vacuous test.

Success Criteria

• t27c test-report specs/igla/coder/hslm_bwd_host.t27 exits 0.
• t27c seal specs/igla/coder/hslm_bwd_host.t27 exits 0.
• The duplicate-body ratchet (tools/dupe_scan) reports no new duplicate body.