Audit outside-funnel packed-payload paths for the per-tensor {1,0} length hole

Pre-existing gap class surfaced by the BFP epic PR4 plan review (F1/F2/F8), deliberately NOT fixed inside PR4 beyond the layers PR4 owns.

A per-tensor BFP grid `{numGroups = 1, groupSize = 0}` is valid for ANY element count, so `validateBfpQConfigShape` alone never catches a length mismatch between two per-tensor wires — the same hole #420 G3 closed for the float accumulate wrappers and PR4's `bfpRequireElementCount` closes for Relu/Flatten/Dropout/pool wires.

**Task:** audit every remaining outside-funnel packed-payload copy or pairwise-walk path for the same hole (serialization round-trips, converter entries not covered by #421's `validateBfpQConfigShape` additions, any future outside-funnel layer), and add `bfpRequireElementCount`-style equality gates where a short operand would silently partial-walk. `BfpKernelSupport.h` (PR4 branch) carries the canonical helpers.

Blocked on: epic PR4 + #421 merges (the helpers and the already-covered sites live on those branches — the audit should run against the merged state to avoid double-filing).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01UzyrYp4e8J2tRjAbkhtnwo

After epic PR4 and #421 merge, start with BfpKernelSupport.h and audit serialization round-trips, converter entries, and other outside-funnel packed-payload copy or pairwise-walk paths. Compare each path with the canonical bfpRequireElementCount helper and add equality gates wherever a short operand could be partially walked; done means all remaining outside-funnel paths are covered without duplicating PR4 or #421 work.

Written by the indexing model from the issue text.