MaxPool1d FLOAT32/SYM hardening parity: argmax content bounds, geometry consistency, auxOut NULL guard

Pre-existing MaxPool1d FLOAT32/SYM gaps surfaced by the BFP epic PR4 reviews (plan review F7 + wave-2 review FU-3/FU-4) and deliberately NOT fixed inside PR4. The new BFP arms are hardened; the FLOAT32/SYM arms next to them are not.

1. **Backward trusts argmax content** (plan F7): `maxPool1dBackwardKernelFloat` / `…SymInt32` reject only the negative sentinel; an index `>= inputLength` (e.g. a stale argmax recorded by a differently-shaped forward) scatters past the end of the gradient buffer. The argmax tensor is kernel-written and never funnel-converted, so nothing upstream validates it. Fix model: the bounds check in `maxPool1dBackwardKernelBfp` (−1 legal, `>= inputLength` dies, −1-success positively asserted). Sentinel strictness belongs in the same fix: exactly `−1` is the sentinel — the float/SYM arms' `< 0` skip silently absorbs corrupt negatives (the PR4 adversarial gate flagged the same laxness in the BFP arm; its fix is queued on that branch).
2. **Backward lacks a geometry-consistency check** (wave-2 FU-3): the AvgPool twin validates `geom.outputLength != outputLength`; MaxPool's dx kernels (ALL arms, BFP included) validate only shapes and argmax content — a stale kernel config produces silently wrong dx instead of a guided death. Parity item across all three arms.
3. **Forward dereferences `auxOut` without a NULL check** (wave-2 FU-4): all three forward arms read `auxOut->shape`/`auxOut->data` directly. `initMaxPool1dConfig` rejects a NULL `argmaxIndices`, but the factory-bypass path (the reason the R-P1 anchor exists) can reach the kernel with a NULL `.auxOut` → segfault instead of a guided message.

Blocked on: epic PR4 merge (the model code lives on that branch).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01UzyrYp4e8J2tRjAbkhtnwo

Start on the PR4 branch with maxPool1dBackwardKernelFloat and maxPool1dBackwardKernelSymInt32, then compare their checks with maxPool1dBackwardKernelBfp and the AvgPool geometry validation. Review initMaxPool1dConfig and all three forward arms for auxOut handling. Done means exact −1 sentinel handling, argmax bounds checks, geometry consistency checks across dx kernels, and NULL guards in every forward arm.

Written by the indexing model from the issue text.