fix: stream-order GPUStorage host access (Bug 11, Wolf batch-3 gradient NaN)

[dndungu]

Problem (Bug 11, zerfoo#850 lineage)

Wolf CrossAsset GB10 f32 training (verify5/6 on image d33ee2da, all prior
fixes in) still hits a deterministic NaN in layer0.ffnB1_biases at batch 3:
forward pass clean, per-sample accumulated gradients finite, yet the AdamW
guard reads NaN at the batch boundary. Bugs 9 (zerfoo#851/#852) and 10
(ztensor#134) removed the arena-lifetime causes; the remaining entry point is
the host read itself.

Root cause

GPUStorage host-access paths (TrySlice/Slice/CopyTo/TrySet/Set)
relied on synchronous cudaMemcpy's implicit legacy-stream ordering against
the engine's (blocking) stream. On cache-coherent unified-memory platforms —
the GB10's NVLink-C2C — a "synchronous" pageable-memory copy may be serviced
without waiting for kernels pending on a non-default stream, and managed
storage is accessed directly through the unified pointer with no CUDA call
at all. A host read can therefore observe bytes from before a still-async
kernel write. In the Wolf schedule, zerfoo's gradAccumulator.addInto host
fallback reads the bias gradient (grad.Data() → TrySlice) immediately
after the async Bias Sum kernel is enqueued — garbage bytes → NaN folded
into the persistent accumulator.

Fix (contract level — any workload benefits)

A host access to GPU memory is now stream-ordered with respect to pending
device work:

• tensor.RegisterHostAccessSync(deviceID, fn) — per-device sync hook
  registry (same indirection pattern as the arena poison kernel fill; tensor
  cannot import compute).
• Every GPUStorage host read/write runs the device's hooks before touching
  memory (managed and discrete paths alike); hook errors fail the access.
• GPUEngine registers stream.Synchronize() at construction
  (capture-guarded: syncing during CUDA graph capture is illegal, and capture
  paths never host-read kernel outputs) and unregisters on Close.
• Graph.Engine() getter so training utilities can run gradient-maintenance
  ops on the graph's own engine/stream (consumed by the zerfoo follow-up).

Tests

tensor/host_access_sync_test.go: a fake runtime where a pending async write
becomes visible only at sync — TrySlice/Slice/CopyTo read stale bytes and
fail without the fix (verified red), plus write-ordering, error-propagation,
and registry semantics. go build ./..., CI-equivalent go vet, and
go test -race ./... all green locally.