Complete ADR 0012 CDC jitter injection (deferred scope)

[robtaylor]

Summary

ADR 0012 — Reproducible CDC jitter injection is Accepted and partially implemented. The reproducibility core and basic scheduler-domain jitter on the VCD timeline are in; several parts of the decided design are not yet built. This issue tracks the remaining work. Full design + an implemented-vs-deferred breakdown live in the ADR; the implementation plan is in docs/plans/cdc-jitter-completion.md.

Implemented today

• Run-parameters file + per-domain seeded PRNG (src/sim/run_params.rs, RunParams::domain_seed).
• jitter_ps per ClockConfig; per-domain ChaCha8Rng; uniform [-jitter_ps, +jitter_ps] draw.
• VCD-timeline jitter: displacement applied to the timing-VCD event timestamp (only when --timing-vcd is set).
• --check-with-cpu + jitter warning.

Deferred (this issue)

• Setup/hold integration — jitter currently shifts only the VCD base_timestamp; it does not feed per-signal arrival offsets, so it cannot produce --timing-report violations (ADR §5). Wire the displacement into the arrival values the checker consumes.
• Model-driven clock jitter (ADR §3) — --cdc-model-jitter-ps / per-model jitter_ps, displacing model-driven edges (JtagReplayModel, SPI, …). No patch_model_clock_edges path exists yet.
• True coincident-edge perturbation (ADR §4) — today a single global displacement (last firing domain wins) is applied to the shared timestamp; model independent per-domain displacement so A-before-B vs B-before-A is actually exercised.
• gcd_ps / 2 constraint (ADR §2) — validate jitter_ps <= gcd_ps/2 at startup and error/clamp otherwise.
• Persist seed unconditionally (ADR §1) — when neither --run-params nor --timing-vcd is given, the seed is generated but not written; always persist so any run is replayable.
• master_seed in VCD header comment (ADR §1/§5) — currently INFO-logged only.
• CI CDC stress sweep (ADR Consequences) — small seed sweep on PRs once jitter feeds violations.

Acceptance

Each box reconciles the ADR's present-tense design with the implementation; closing this issue means ADR 0012's "Deferred until this issue" section is empty.