t27b lane 4: four specs blocked by spec defects (dqn, hex, gen_image, args) #7372

Part of #6063 (t27b lane 4).

Four specs are on the t27b ledger as blocked, but the blocker is in the spec, not in the backend. Each one also passes the reference for a reason that checks nothing.

• specs/ml/rl/dqn.t27: the tests call default_input() and valid_input(), which are declared nowhere, and assert then true. The fns ignore their inputs.
• specs/tri/crypto/hex.t27: encode(codec) -> void and decode(input) -> void are empty. Their tests assert result == undefined on a void result.
• specs/port/trinity/src/tri/gen_image.t27: Image_init, Image_setPixel and Image_deinit have the body undefined; and take *std.mem.Allocator. No test calls them, and one test asserts always_true() == true.
• specs/tri/utils/args.t27: parse(allocator) -> void does _ = allocator;, and its one test is then true. ci-gates section 342 records that the Lean model of this fn was provable only because it split the dotted type into three parameters.

The fix is on the spec side, from the source each port names:

• dqn: the mutation-checked restoration from specs/algo/dqn.tri, from branch loop/auto-2026-09-29 (PR Auto-loop 2026-09-29: silent-discard parser family + loop infrastructure #5084).
• hex: trinity src/tri/gen_hex.zig.
• gen_image: trinity src/tri/gen_image.zig.
• args: trinity src/tri/gen_args.zig.

In each, the allocator becomes a caller buffer or goes away, the tests check real values, and the tests are mutation-checked.

Done when:

• t27c test-report passes all four specs with 0 vacuous passes;
• t27b test --check passes hex, args and gen_image;
• dqn's ledger row names the first backend construct it now stops at;
• the seals are current.