Add pecos-frontier: native Frontier approximate logical-ML decoder

[ciaranra]

Summary

Adds pecos-frontier, a native Rust implementation of the Frontier decoder
(Leverrier & Urbanke, arXiv:2606.20513): pruned ordered dynamic programming that
approximates the logical maximum-likelihood rule by accumulating posterior mass per
logical class (merging degenerate error configurations) rather than searching for a
single most-likely error. This targets qLDPC/DEM decoding problems; the paper reports
state-of-the-art accuracy on the gross code [[144,12,12]] under circuit-level noise
with small retained frontier sizes.

Decision record: the upstream project is a Python package whose engine is a single raw
CPython extension with no standalone C++ target or C API, and its performance-critical
model preparation lives in Python — so this is a native port with the upstream package
used as a verification oracle, not an FFI wrap (unlike Tesseract/PyMatching, which
build standalone C++ from pinned sources).

What's included (v1, binary model)

• FrontierDecoder::{from_sparse_dem, from_dem_str} building columns directly from
  SparseDem mechanisms; explicit FrontierConfig { k, delta, column_order } with
  fail-fast validation (provisional defaults pending benchmarking). Duplicate indices
  within a mechanism are rejected; p == 1 mechanisms are supported by exact folding
  into the decode start state.
• Ordered DP core: boundary states keyed by (active residual syndrome, logical label),
  log-sum-exp merging, completed-detector consistency checks, deterministic K/Delta
  pruning (no map-iteration-order dependence; total-order tie-breaks).
• ObservableDecoder implementation returning wide ObsMask (no 64-observable cap;
  decode_to_observables fails loud past 64). FrontierResult reports per-label
  retained log masses, total log_evidence (upstream semantics), runner-up gap, and
  frontier-size stats.
• No-path decoding failures are errors, never silent fallbacks.
• Lives in exp/pecos-frontier (experimental, publish = false): the algorithm core is
  oracle-verified, but the crate graduates to crates/ and the pecos-decoders
  meta-crate only after broader validation with real users.

Verification

• Exact-equivalence property tests: unpruned decoding must reproduce brute-force
  enumeration over all fault subsets (per-label log masses to 1e-9 and argmax) on 33
  seeded random hyperedge DEMs, including reversed column orders.
• Upstream golden-fixture parity: tests/fixtures/upstream_fixtures.json is generated
  by the committed script against the upstream Python+C++ package; unpruned per-label
  masses, predicted labels, and log evidence match to 1e-9 across 5 models x 46
  syndromes (including a >64-observable model and a degeneracy case where logical-ML
  disagrees with most-likely-error).
• Guard non-vacuousness was mutation-tested (merge math, close-check, tie-break,
  K truncation each break tests when altered).
• Targeted tests: pruning changes the answer (greedy k=1 wrong, exact right), bitwise
  determinism including ties, fail-loud unexplainable/overpruned syndromes, config and
  DEM validation, trait-object use.

Accuracy vs upstream (measured)

score_alpha suffix-compatibility pruning is now ported (the paper's S = P + alpha*C
scoring; default alpha 0.8 matching upstream), so pruned decoding uses upstream's rule,
not a prefix-mass-only approximation. Golden-fixture parity is enforced for BOTH
unpruned and pruned regimes at 1e-9. A head-to-head on an identical d3 rotated-surface
circuit-noise model (identical deadline-reorder column order, identical 2000 sampled
shots, forward-only, K in {2,4,8,16}) matches upstream's per-shot predictions exactly
in the alpha=0.8 lane at every K; the alpha=0 lane differs on 3-4 shots per 2000 from
equal-score tie ordering only. Runtime is ~1.3-1.5x upstream's C++ per shot. The
bridge_ab example is the committed cross-implementation harness.

Review

Two independent adversarial Codex arms (diff review + fresh-session semantics attack
against the paper and upstream implementation) ran before marking ready; confirmed
findings (wide-label tie-break word order, duplicate-index semantics, p == 1 support,
pruning-rule disclosure, mass-naming precision) are fixed in the final commits.

Ordering, committee, and Python API (added after the initial review rounds)

• deadline_column_order / backward_deadline_column_order: native generation of
  upstream's ordering heuristics, permutation-exact against upstream on golden fixtures.
• FrontierCommittee: forward/backward two-leg decoding with upstream's selection rule,
  parity-tested (status, label, direction, evidence) including fixtures where the
  backward leg wins.
• Python bindings in pecos_rslib_exp: FrontierDecoder / FrontierCommitteeDecoder
  with the pecos_rslib.decoders API shape (from_dem + kwargs, sparse decode,
  dense decode_syndrome, decode_batch), column_order presets matching upstream
  vocabulary, and arbitrary-precision observables_mask (works past 64 observables).
  Verified by maturin-built extension + pytest (6 tests), reproduced independently.

Out of scope (follow-ups tracked in the design note)

• The multi-choice (grouped hyperedge) model, the integer max-log ("frontierLite")
  metric mode, and performance work (incremental suffix-score deltas); tracked in the
  design note with reasons.