Fix CP HiCache load_cp owner-pattern mismatch (cache-hit corruption)

In CP=8 + NSA-shared-KV + HiCache disagg-prefill, cache-hit prefill produced
incoherent decode output. Cold prefill on CP was correct; pure CP without
HiCache was correct. The bug lived at the HiCache load_cp / device-alloc
interface.

Root cause: cache_controller.load_cp called the plain
mem_pool_device_allocator.alloc(logical_len), which returns logical pages
with no CP owner-pattern preservation. Cold prefill instead uses
alloc_extend_compute_owner with a zigzag owner pattern from
build_in_seq_page_compute_owners. The saved CpHiCacheNodeMetadata.owned_positions
records WHICH POSITIONS in the write-time alloc were owned by this rank. At
load time, those same positions are applied to a new alloc whose per-position
owner pattern is arbitrary -- each rank loads its host bytes into physical
slots whose corresponding logical page is owned by a DIFFERENT rank.
Attention's materialize_shared_token_kv_buffer reads from the owner's
physical slot, which was never loaded. Result: garbage.

Fix:
- CpHiCacheNodeMetadata gains two required fields: page_owners (int8 per
  logical page, identical on all CP ranks) and page_size. __post_init__
  validates; split() bisects page_owners by page index with a page-alignment
  check.
- _write_cp derives page_owners from device_indices (page-first slot of each
  page -> logical page id -> layout.owner_for_logical_pages) and stores in
  both metadata-construction sites (zero-owned and normal).
- New CPSharedPagedTokenToKVPoolAllocator.alloc_pages_with_owners() reuses
  _select_compute_owner_pages (with its tai-kernel fast path) and returns
  page-contiguous token locs whose per-page owner sequence equals the input.
- load_cp now concats page_owners across nodes_to_load and calls
  alloc_pages_with_owners. On None (lane exhausted) the caller hits the
  retry-with-eviction path; further failure returns None and degrades to
  cache miss. No silent fallback to plain alloc -- that recreated the bug.
- load_back retry path now calls _evict_for_compute_owner_lanes (module-top
  import) instead of plain evict(); this targets the deficit lane and gives
  the next alloc attempt a chance to satisfy it.
- envs import moved to module top in cache_controller.py per code-review
  feedback. Removed an over-defensive owned_check.all().item() in load_cp
  that would have re-introduced the host-sync anti-pattern 97a9f850c
  removed -- the invariant is already guaranteed by alloc_pages_with_owners.

Tests: 40 existing CpHiCacheNodeMetadata constructions migrated to pass the
new required fields. 9 new metadata tests (validators + split page-alignment).
10 new allocator tests in test_alloc_pages_with_owners.py covering input-order
preservation, lane exhaustion, release_pages fallback, debug-mode invariant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test/registered/unit/managers/test_hicache_controller_cp.py

@@ -425,6 +425,8 @@ class TestHiCacheControllerCPLoad(TestHiCacheControllerCPWrite):
             logical_len=16,
             owned_positions=torch.tensor([4, 5, 6, 7], dtype=torch.int64),
             host_indices=torch.tensor([100, 101, 102, 103], dtype=torch.int64),
+            page_owners=torch.zeros(max(16, 0), dtype=torch.int8),
+            page_size=1,
         )
 
         device_indices = controller.load_cp([node], node_id=11)
@@ -455,6 +457,8 @@ class TestHiCacheControllerCPLoad(TestHiCacheControllerCPWrite):
             owned_positions=torch.tensor([4, 5, 6, 7], dtype=torch.int64),
             host_indices=torch.tensor([100, 101, 102, 103], dtype=torch.int64),
             draft_host_indices=torch.tensor([200, 201, 202, 203], dtype=torch.int64),
+            page_owners=torch.zeros(max(16, 0), dtype=torch.int8),
+            page_size=1,
         )
 
         device_indices = controller.load_cp([node], node_id=14)
@@ -477,6 +481,8 @@ class TestHiCacheControllerCPLoad(TestHiCacheControllerCPWrite):
             logical_len=4,
             owned_positions=torch.empty((0,), dtype=torch.int64),
             host_indices=torch.empty((0,), dtype=torch.int64),
+            page_owners=torch.zeros(max(4, 0), dtype=torch.int8),
+            page_size=1,
         )
 
         device_indices = controller.load_cp([node], node_id=12)
@@ -524,6 +530,8 @@ class TestHiCacheControllerCPLoad(TestHiCacheControllerCPWrite):
             logical_len=16,
             owned_positions=torch.tensor([4, 5, 6, 7], dtype=torch.int64),
             host_indices=torch.tensor([100, 101, 102, 103], dtype=torch.int64),
+            page_owners=torch.zeros(max(16, 0), dtype=torch.int8),
+            page_size=1,
         )
 
         with self.assertRaisesRegex(
@@ -541,6 +549,8 @@ class TestHiCacheControllerCPLoad(TestHiCacheControllerCPWrite):
             logical_len=16,
             owned_positions=torch.tensor([4, 5, 6, 7], dtype=torch.int64),
             host_indices=torch.tensor([100, 101, 103, 102], dtype=torch.int64),
+            page_owners=torch.zeros(max(16, 0), dtype=torch.int8),
+            page_size=1,
         )
 
         with self.assertRaisesRegex(ValueError, "host_indices.*contiguous page spans"):