fix(pf-encode): AUTO split is conditional on sub-frame — do NOT retire the arm

Last change's docs concluded "AUTO never splits, retire the arm" from the
sub-frame-ON measurement alone. Measured the missing leg before implementing it,
and the conclusion was wrong.

On .21 at 4K, plain AUTO (env unset, the resolver's fallthrough):
  sub-frame ON  -> 5023/5157 us/frame ~= DISABLE 4979/5000   (does NOT split)
  sub-frame OFF -> 2401/2352 us/frame ~= TWO_FORCED 2319/2378 (DOES split)

So AUTO is CONDITIONAL, not dead. Retiring it would have silently cost every
sub-frame-off session its second engine -- a regression introduced while
"cleaning up" an arm that looked inert. Split and sub-frame are mutually
unsupported for HEVC, so the driver resolves AUTO to no-split only in that
combination.

Fix is disclosure, not removal:
- resolve_split_subframe debug-logs the inert HEVC + AUTO + sub-frame case, which
  is the fleet default shape: "split_mode=AUTO" has meant "no split" for every
  default session and nothing said so. Deliberately NOT rewritten to DISABLE --
  the mode we pass is what the driver was actually given, and the ceiling-cache
  key must keep describing that.
- New unit test `auto_survives_the_arbitration_in_both_subframe_states` pins the
  contract so the arm cannot be simplified away later.
- The resolver doc now records both measured legs instead of "AUTO is dead".

Also in this change:
- WP1.6: `resolve_subframe`'s doc said "Windows passes `false`". Stale since the
  2026-07-31 .173 A/B flipped Windows to caps-gated default-on. It mattered:
  it made the AUTO-plus-sub-frame dead combination look Linux-only when it is
  fleet-wide.
- Windows session-ready log parity: split_mode + engines + subframe. The Windows
  line had no split_mode at all, so a Windows field report could not answer "did
  this session actually split?" -- the question that started this whole thread.

Verified: fmt clean; .21 clippy -p pf-encode --features nvenc --all-targets
-D warnings clean, 58 unit tests (1 new), 22/22 NVENC on-hardware tests green;
.133 Windows clippy --features nvenc --all-targets -D warnings clean (15m cold,
zero errors or warnings) -- the Windows backend is cfg'd out on both macOS and
the Linux box, so that leg needed a real Windows host.

crates/pf-encode/src/enc/linux/nvenc_cuda.rs

@@ -3456,11 +3456,29 @@ mod tests {
         let (auto_us, auto_sub) = run(None, None);
         let (dis_us, dis_sub) = run(Some("0"), None);
         let (two_us, two_sub) = run(Some("2"), Some("0"));
+        // The leg that decides whether the `AUTO` arm can simply be RETIRED: D5 proves AUTO does
+        // not split while sub-frame is on, but retiring it would also change sub-frame-OFF
+        // sessions, where AUTO is free to split and might. Measure before removing.
+        let (auto_nosub_us, auto_nosub_sub) = run(None, Some("0"));
 
         println!("D5 confirm @ {W}x{H}@60 HEVC 8-bit:");
         println!("  AUTO (unset) + sub-frame({auto_sub}) : {auto_us:>6} us/frame");
         println!("  DISABLE      + sub-frame({dis_sub}) : {dis_us:>6} us/frame");
         println!("  TWO_FORCED,   no sub-frame({two_sub}): {two_us:>6} us/frame");
+        println!("  AUTO (unset), no sub-frame({auto_nosub_sub}): {auto_nosub_us:>6} us/frame");
+        println!(
+            "  ⇒ with sub-frame OFF, AUTO is nearer {} — retiring the AUTO arm {}",
+            if auto_nosub_us.abs_diff(two_us) < auto_nosub_us.abs_diff(dis_us) {
+                "TWO_FORCED (it DOES split)"
+            } else {
+                "DISABLE (it does not split either way)"
+            },
+            if auto_nosub_us.abs_diff(two_us) < auto_nosub_us.abs_diff(dis_us) {
+                "would LOSE a real split on sub-frame-off sessions"
+            } else {
+                "is behaviour-neutral"
+            }
+        );
         assert!(
             auto_sub,
             "the AUTO leg resolved sub-frame OFF — it is not testing D5's fleet shape"