QVAC-23767 abot: destroy ModelManager before the runners that own its tensors

[DmitryMalishev]

Teardown-ordering fix on 2026-08-11, declaration-order only — no API or behavior change.

Bug. ~ModelManager force-frees the param storage blocks and writes through the registered ggml tensors (free_params_storage_block: state->tensor->buffer = nullptr). Those tensors live in the runner contexts, and runners hold only weak_ptr refs to the manager — so the manager must be destroyed first, while the tensors are still alive. StableDiffusionGGML gets this right by declaring model_manager after its runner members. Both ABot entry points on this branch had it inverted:

• AbotWalkSession declared model_manager before runner/tae → member destruction killed the runners first → ~ModelManager wrote through dangling pointers at sd_abot_session_free.
• sd_abot_scene_create declared the manager local before the t5/vae runners → same inverted teardown at scope exit — crashing (STATUS_HEAP_CORRUPTION/SIGSEGV) after the scene pack had already been written successfully.

How it surfaced. The qvac diffusion 2026-08-11 pair bump (QVAC-23767 / qvac#3978): the addon's abot-world integration test died with exit 139 right after the umT5 load on both linux-x64 GPU legs (run). Reproduced deterministically on a CPU-only Windows build; gdb stack:

#0 ModelManager::free_params_storage_block  (model_manager.cpp:1039)  state->tensor->buffer = nullptr;
#1 ModelManager::release_params_storage_blocks(force=true)
#2 ModelManager::release_all
#3 ModelManager::~ModelManager
#9 sd_abot_scene_create  (scope exit)

Fix. Mirror StableDiffusionGGML's ordering: declare the manager after the runners in both places (members in AbotWalkSession, locals in sd_abot_scene_create).

Validation (local, CPU, umT5-Q8 + Wan2.2-VAE-f16 + DiT-Q8 + taew2_2-f16):

• Before: scene create crashes at teardown every run (pack already written); walk session crashes at sd_abot_session_free.
• After: scene create rc=0 (scene written to … 832x480); full walk block rc=0 (9 frames, 832x480, decoded via TAE, clean exit).

Consumed by qvac-registry-vcpkg#325 (the 2026-08-11 engine-pair ports) — the port REF bumps to this branch's merge result together with qvac-ext-ggml#64.

---

Validation update (2026-08-25, final CI proof). The full qvac addon matrix ran with this fix (+ #35) overlaid on branch tip a20856b (validation stack 9c013c8): run 32857044906 — all 9 prebuilds, all cpp-tests, and all integration legs green, including the previously-crashing linux GPU legs: ok 3 - ABot-World: full world generation - native scene creation + KV-cache walk on qvac-ubuntu2204-x64-gpu and qvac-ubuntu2404-x64-gpu. (The single red job in that run, cpp-lint, is the known qvac-ubuntu2204-x64 runner-pool clang/libc++ mismatch — infra, unrelated.) Counter-evidence that the bug bites without this fix: qvac#3923's branch (pins the tip without #32) dies with exit 139 right after ABot model load on the same leg: job 97769331999.

---

Stack & review aids (2026-08-25, per reviewer request). This PR is the BASE of a two-PR stack: #32 (this) → #35 (its base is this branch; merge this first, #35 then retargets automatically). The branch was rebased onto the current 2026-08-11 tip a20856b for the stack (commit is now 81b8ccf, content unchanged). The consuming qvac addon PR #3978 now carries overlay ports on its own branch pinning ggml 7d9ce11 (merged 2026-08-11 tip) and stable-diffusion-cpp f1c8b80 (this stack's tip, tree-identical to the validated 9c013c8): overlay-ports. Fresh full-matrix proof run on exactly these pins: run 32865301949.

Review-round update (2026-08-26). #35 (the stack top) gained review follow-up hardening 97b9033 (shared fallback-reroute helper covering retry_stateless_on_cpu, two-phase assign_compute_backend, fatal failed-restore handling) — this PR's diff is unchanged. New stack tip = 97b9033; the #3978 overlay is repointed at it. Fresh proof, all green: engine matrix 32959554240, full qvac matrix 32959700401 (win32 74/74 incl. both Wan smokes; ABot green on both linux GPU legs).