Refactor(a5): align profiling stack with a2a3 (host CRTP + stable ring)

[ChaoZheng109]

Summary

Brings a5's profiling stack to the same shape as a2a3 (PRs #705 / #709 / #714):

• Host CRTP framework: L2PerfCollector / PmuCollector / TensorDumpCollector now derive from ProfilerBase<Derived, Module> over a shared BufferPoolManager<Module> under src/a5/platform/include/host/profiling_common/. Mgmt + poll threads + buffer pool logic deduplicated across three collectors.
• Stable AICore staging ring: AICore writes per-task records to a per-core L2PerfAicoreRing / PmuAicoreRing allocated once by the host; address is published via KernelArgs::aicore_*_ring_addrs[block_idx] and never reassigned. Decouples AICore writes from AICPU's rotating records buffer, and fixes the latent PMU buffer-flip bug where AICore kept writing to the stale buffer.
• Profiling out of Handshake: enablement bits + per-core address arrays moved from runtime Handshake to KernelArgs + AICore platform-owned slots (aicore_profiling_state.h). Adding a new profiling field no longer touches the runtime sync protocol. AICore resolves its PMU MMIO base directly from the existing KernelArgs::regs table at kernel entry (regs[get_physical_core_id()]), so there is no separate per-core pmu_reg_addrs table and no AICPU-fill-after-handshake dependency — the reg base is stable from Phase 1, and aicore_execute caches it at Phase 3 alongside the rings.
• Three-bucket reconcile: L2PerfBufferState and PmuBufferState now track total / dropped / mismatch; collectors cross-check collected + dropped + mismatch == device_total per pool, matching a2a3.

a5's transport channel still differs from a2a3 (no halHostRegister on DAV_3510). The framework absorbs that as:

• MemoryOps carries 5 callbacks (adds copy_to_device / copy_from_device)
• mgmt loop mirrors the shm region per tick via profiling_copy.h
• release_owned_buffers frees the paired host-shadow malloc()

Docs

• docs/profiling-framework.md §8 — new a5-specifics section
• docs/dfx/{pmu-profiling,l2-swimlane-profiling,tensor-dump}.md §5.x — a5 transport channel + lifecycle + reconcile semantics updated to match the code as it stands

Naming note

a5's new KernelArgs fields are named *_addrs (plural) for the per-core address arrays: aicore_l2_perf_ring_addrs, aicore_pmu_ring_addrs. a2a3's aicore_ring_addr (singular but pointing to an array) is logged for a follow-up a2a3 rename PR; not touched here per the arch-independence rule.

Test plan

• python -m simpler_setup.build_runtimes --platform a5sim — host_build_graph + tensormap_and_ringbuffer build clean
• a5sim CI (./ci.sh -p a5sim)
• a5 hardware smoke
• Verify reconcile equation collected + dropped + mismatch == device_total matches per pool on a representative case

[gemini-code-assist]

Code Review

This pull request refactors the profiling framework for the a5 architecture, centralizing host-side infrastructure for PMU, L2Perf, and TensorDump collectors. Key architectural changes include migrating profiling state from the runtime handshake to KernelArgs, introducing stable AICore staging rings to decouple writes from buffer rotations, and implementing a host-shadow transport mechanism to support systems without SVM. Review feedback recommends adding warning logs for null headers during buffer switches and utilizing store barriers when initializing hardware registers to prevent race conditions on weak memory model architectures.