[knapcio]

What

Ports Liangsheng Yin's merged SGLang #45301 (117247ea) to the pinned V4.1 attention class split.

• keep one TP-padded query allocation per graph metadata object
• grow it only before capture and reuse row slices for smaller graph buckets
• fail closed if a later shape/dtype would replace captured storage
• add a source verifier, CPU behavior falsifier, image-build checks, changelog/watch notes, and upstream credit

The pinned tree contained the exact vulnerable behavior: replacing q_pad_buffer on every shape change. A captured decoder-tail graph could therefore retain a freed address and upstream reproduced an MMU fault after cache flush.

Validation

• clean exact-pin staging with the complete patch train and --fuzz=0: PASS
• staged production-source verifier + behavior falsifier: PASS
• exact offline matrix: 132 passed, 1 expected image-only skip
• Python/shell/diff/content-pin checks: PASS

No GPU/RDMA/TPS claim is made; model-level GPU qualification remains separate.

Upstream credit: Liangsheng Yin / hnyls2002, sgl-project/sglang#45301