Add Tofino model PTF gate

[ZER0-Nu1L]

Summary

• promote the Tofino CI lock to the reviewed sde-9.13.4-tofino1-r3 Release and immutable GHCR digest
• verify the checked-in lock byte-for-byte against the Release asset and its published checksum manifest
• add project PTF coverage for permitted forwarding, non-permitted drops, BFRT mapping reconfiguration, retired-path drops, and startup-state restoration
• make the production BFRT backend compatible with both the current Open P4 Studio 9.13.4 client API and the older client interface
• update pinned GitHub Actions and document the CI/release boundary

Release: https://github.com/ZER0-Nu1L/open-p4studio-container/releases/tag/sde-9.13.4-tofino1-r3

Image:

ghcr.io/zer0-nu1l/open-p4studio-container@sha256:11f1c2ecb12f5a895082c6256be84be6729f1ad9ab639519f9df9529445b0613

Validation

• python3 -m unittest discover -s targets/tofino/ci/tests -v — 6 passed
• Agent Python suite — 42 passed locally (1 optional pyang skip); 42 passed in the P4App test image
• Tofino runtime suite — 4 passed
• (cd agent/go && go test ./...) — passed
• make -C targets/p4app test — passed with Python 3.9 and YANG validation
• make -C targets/p4app test-container — passed
• actionlint v1.7.12 — passed
• all updated Action tags were independently resolved to their pinned full commit SHAs
• live Release lock verification — passed
• r3 compile-only run — passed
• r3 full privileged software-model run — passed with Ran 1 test / OK

The full local run produced BFRT readback for the initial and updated six-entry mappings, verified 6 permitted and 24 dropped non-self paths, dropped all 6 retired paths after reconfiguration, and restored/read back the initial mapping.

Boundary

This validates compilation plus the Tofino 1 software model, BFRT, veth packet I/O, and project PTF behavior. It does not validate a physical Tofino board, BSP, SerDes, firmware, site-specific port mapping, or optical hardware.

[ZER0-Nu1L]

Final promotion evidence for head cf382592e49b4a42ef4cd22b1e2b79eeed1c2b49:

• https://github.com/ZER0-Nu1L/ReconfigNet-Sim/actions/runs/33162857763 — success
• https://github.com/ZER0-Nu1L/ReconfigNet-Sim/actions/runs/33163098364 — success
• https://github.com/ZER0-Nu1L/ReconfigNet-Sim/actions/runs/33163289364 — success

The three workflow_dispatch runs were executed serially against the same commit. For each run I downloaded tofino-model-<run_id> and verified:

• ptf.log contains Ran 1 test and OK
• bfrt-initialize.marker contains ocs-bfrt-initialized
• initial BFRT readback matches [6,3,2,5,4,1]
• updated BFRT readback matches [2,1,4,3,6,5]
• restored BFRT readback matches the initial mapping
• timing records DELTA, NATIVE_BATCH, 6 deletes, 6 inserts, 6 active entries, and software readback verification

This is software-model/BFRT/PTF evidence only, not physical Tofino or optical-hardware validation.