fix: route nemotron omni audio-encoder convs through fallible FFI

[inureyes]

Summary

Extends the #427/#434 defense-in-depth conv hardening to the Nemotron-H Nano Omni Parakeet/Conformer audio encoder. Its data-dependent conv2d/conv1d ops are now built through the fallible try_conv2d/try_conv1d FFI wrappers so a crafted audio request whose runtime-derived shape mismatches the conv weights returns a per-request Err instead of an uncaught C++ throw that std::terminate-aborts the server for all clients (the remote-DoS class documented in ADR 0003, first addressed for audio synthesis in #384).

What changed

• src/audio/nemotron_h_nano_omni/encoder.rs: route the four data-dependent conv calls through the already-existing (#434) fallible variants: subsampling conv2d (SubsamplingConv2DLayer::forward) and the convolution module's pointwise1 / depthwise / pointwise2 conv1d (ParakeetConvModule::forward), each with a descriptive .map_err(...).
• src/audio/nemotron_h_nano_omni/encoder.rs: thread Result<_, String> up the forward chain that transitively calls a conv: SubsamplingConv2DLayer::forward, ParakeetSubsamplingConv2D::forward, ParakeetConvModule::forward, ParakeetEncoderBlock::forward, and the public NemotronOmniSoundEncoder::forward. Conv-free forward methods (LayerNorm, BatchNorm, FeedForward, Attention, GLU/norm helpers) stay infallible, so no per-op overhead is added to statically-shaped paths.
• src/vision/nemotron_h_nano_omni_vl.rs: NemotronHNanoOmniVlModel::extract_audio_features (already -> Result) propagates the encoder error with ?; its request-path caller compute_nemotron_h_nano_omni_audio_embeddings already maps it to an anyhow request error, so the fault surfaces as a per-request error at the request boundary.
• src/audio/nemotron_h_nano_omni/encoder.rs: add an encoder-level abort_safety_tests module asserting SubsamplingConv2DLayer::forward with a channel-mismatched weight returns Err (complements the try_conv2d/try_conv1d FFI Err tests added in fix: make conv2d/conv1d fallible at the FFI boundary so conv shape faults don't abort the server #434).
• src/audio/nemotron_h_nano_omni/encoder_tests.rs: update the three existing encoder.forward(...) call sites for the new Result return.

Notes

• The cxx C++ bridge is unchanged: try_conv2d/try_conv1d already exist (merged in fix: make conv2d/conv1d fallible at the FFI boundary so conv shape faults don't abort the server #434), so this PR is Rust-only.
• Happy path is byte-identical to the prior non-fallible conv ops (the fallible wrappers have identical bodies, only the return type differs).

Test plan

• cargo check --bin mlxcel --features metal,accelerate
• cargo test -p mlxcel-core --lib --features metal,accelerate ffi_tests::try_conv (4 passed: the conv2d/conv1d Err + Ok-parity tests)
• cargo test --lib --features metal,accelerate nemotron_h_nano_omni::encoder (10 passed, incl. new abort_safety_tests::subsampling_conv2d_layer_returns_err_on_channel_mismatch)
• cargo clippy --lib --tests --features metal,accelerate -- -D warnings (clean)
• cargo fmt --check -p mlxcel (clean)

Closes #435

[inureyes]

PR Finalization Complete

Summary

Tests: added conv_module_pointwise1_returns_err_on_channel_mismatch to the abort_safety_tests module in src/audio/nemotron_h_nano_omni/encoder.rs. It constructs a ParakeetConvModule directly (same module, access to private fields) with a 4-channel pointwise1 weight and a 2-channel input, confirming the first try_conv1d call returns Err on shape mismatch rather than terminating. Pairs with the existing conv2d test in the same block. Both pass.

Documentation: extended the Fault isolation paragraph in docs/audio-api.md and the residual-abort-vector entry plus the References list in docs/adr/0003-release-panic-unwind-with-core-thread-abort.md to record that PR #439 / issue #435 applied try_conv2d/try_conv1d coverage to the Nemotron-H Nano Omni Conformer/Parakeet encoder.

Lint/format: cargo fmt --all --check clean (exit 0). cargo clippy --lib --features metal,accelerate -- -D warnings clean (exit 0).

Verification commands run

cargo fmt --all --check           # exit 0
cargo clippy --lib --features metal,accelerate -- -D warnings  # exit 0
cargo test --lib --features metal,accelerate \
  'nemotron_h_nano_omni::encoder::abort_safety_tests'
# 2 tests: subsampling_conv2d_layer_returns_err_on_channel_mismatch ... ok
#          conv_module_pointwise1_returns_err_on_channel_mismatch ... ok

All checks passing. Ready for merge.