Device-to-host transfer still lowers to a host copy

A transfer into a device space now calls vx_plugin_alloc_and_transfer and the result is a descriptor over device memory. The reverse direction is unchanged: it still lowers to memref.alloc + memref.copy, which reads the source with a host load.

Where the source is real device memory that is a bad pointer dereference, not a slow path.

It is not reachable today, which is why this is filed rather than fixed. The checker refuses the edge for the machine models in fleet/:

Error: Cannot transfer from Custom("HBM") to CPUDRAM: no hardware path exists

So the failure mode is a compile error naming the missing route, not a crash. That is the right behaviour and it is also load-bearing -- the moment a machine model declares a return path, the lowering silently becomes wrong.

What it needs

vx_plugin_transfer_device_to_host(device_ptr, host_ptr, bytes) already exists in the plugin ABI and is implemented by every backend, so the runtime half is done. The lowering should:

• allocate the destination on the host as it does now
• call that entry point instead of memref.copy
• and not free the source, which the producer still owns

Worth doing at the same time as the machine models grow a host-return edge, so the two land together rather than one enabling a broken other.

Related: hiraditya/Vx.1#319 (residency is on the demo's critical path).

Start by finding the existing device-to-host lowering that emits memref.alloc and memref.copy, then inspect the vx_plugin_transfer_device_to_host entry point in the plugin ABI. Review the machine models in fleet/ and their transfer-edge checks. Done means the host destination uses the plugin transfer, the device source remains producer-owned, and the lowering stays aligned with newly added host-return edges.