fix(metal): size gather_qmm_rhs by the broadcast x rows

[inureyes]

Fix Metal gather_qmm_rhs to use the broadcast output row count, so shared activations gathered across sorted slots write every output row. Make two split-MTP tests respect canonical macOS paths and filesystems that reject invalid-byte names; production path and symlink safeguards are unchanged.

The branch includes main 4b0c4519 and MLX pin 59d600b5e. The #1599 quantized.cpp overlay preserves the pin's global-scale changes and the B * M row-count fix.

Candidate Metal nightly 38430123889 failed while compiling the pinned MLX sources at source head 4323eb39, before the #1599 numerical tests ran. Xcode 27 rejected the thread address-space qualifiers carried by decltype(ct_a) and decltype(ct_b) into three gated-delta MPP destination cooperative-tensor factories. The follow-up overlay strips those qualifiers with metal::remove_addrspace_t, matching the pinned tree's working steel NAX helpers and the compatibility issue addressed by upstream MLX #4594. It does not change the cooperative-tensor dtype, descriptor, mode, or algorithm. Independent source review of the functional fix at 1b0ec371 found no correctness, security, or performance issue; head 7d545981 adds the preserved upstream Apple copyright required by the repository license contract. A new candidate Metal nightly is required; no current-head Metal pass is claimed yet.

The earlier candidate Metal nightly 38418557399 passed at source head 2dbffe6d: formatting, Clippy, 12,283 tests (390 ignored), and 51 video tests. That evidence predates the material MLX pin update from 81ba1c6a to 59d600b5e.

Linux focused portability tests pass 2/2, with 123 Python contract tests and 49 WebUI fixtures. These runtime results also predate the material MLX pin update. Independent source review of the rebased row-count overlay at 4323eb39 and the gated-delta compatibility overlay at 1b0ec371 found no source or security issue. The full Python tooling contract passes 123/123 at 7d545981, including the source-license check.

Historical checkpoint evidence remains separate: at exact head 25202198 on M1 Ultra, all five focused Metal mxfp tests passed and Qwen3-30B-A3B-4bit greedy 64-token output matched base and repeated base byte for byte (SHA-256 d2f40b2d5831c3d7790d467fb51123f0d1f615fb7300aa2f92d86a9d8831a0de). The checkpoint smoke was not rerun at the current head.

Keep #1599 open through merge. Close it only after the final integrated main Metal nightly passes.

Refs #1599

[inureyes]

Metal validation passed on Apple M1 Ultra (128 GB), macOS 27.0 (26A428), full Xcode 27 RC, after rebasing this PR onto main b34d517bc422dd0465a6c404cbb2b84d4181124d. Tested head: 25202198c3ea7444cf9aa6b14c059f79683b75ab.

• Main reproduces both SortedSharedActivation non-finite failures: mxfp4 and mxfp8 gather, 3 passed / 2 failed. This is the existing [nightly-verify] main is red #1599 defect.
• PR: all five models::switch_layers::mxfp_tests pass with --profile test-fast --features metal,accelerate -- --test-threads=1. The Metal quantized.cpp object was rebuilt.
• Release build passes. A transient sccache file-descriptor exhaustion was bypassed with RUSTC_WRAPPER=; no source change was needed.
• Qwen3-30B-A3B-4bit, greedy 64 tokens, rainbow explanation prompt: main, main-repeat, and PR generated text are byte-identical via scripts/ab_output_equality.sh; SHA-256 d2f40b2d5831c3d7790d467fb51123f0d1f615fb7300aa2f92d86a9d8831a0de.

This satisfies #2158 item 4's local gate. Keep #1599 open until a post-merge Metal nightly make verify-test passes. M5 was not tested.