perf: back the CPU similarity GEMM with OpenBLAS

The CPU path was a scalar triple loop. It is the correctness oracle for the GPU
backends, but it is also what CI runs — there is no GPU on the N100 host — and
since AR-003 removed the per-frame face cap, a crowded frame now scores many
faces against a library-scale gallery. Scoring one face against 5000 embeddings
is 2.6 MFLOP; in scalar that does not hold up (AR-027).

S(g,f) viewed as row-major [n_faces x n_gallery] is exactly query * gallery^T,
so the loop nest collapses into a single cblas_sgemm.

OpenBLAS is optional in the build: found via pkg-config, and the scalar path
remains when it is absent so no hard dependency is added and the two can be
diffed when a similarity looks wrong. The configure step warns rather than
failing, since a developer without it should still get a working tree.

The test target links it too. Without that the suite compiles the scalar
fallback while the builder image ships CBLAS, so CI would be verifying a kernel
that is not the one running in production — the same class of mistake as testing
a path the gate never executes.

Recorded as required (not optional) in the DP-007 image, for the same reason.

Suite: 92 cases, 6136 assertions, with CBLAS compiled in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: AR-026, AR-027, DP-007 | SR-001

CMakeLists.txt

@@ -152,6 +152,24 @@ if(SAE_GEMM_BACKEND STREQUAL "CPU")
     set_target_properties(gemm_backend PROPERTIES POSITION_INDEPENDENT_CODE ON)
     target_include_directories(gemm_backend PRIVATE src)
     target_compile_definitions(gemm_backend PRIVATE SAE_GEMM_CPU)
+
+    # AR-026/AR-027: back the CPU path with OpenBLAS when present. Optional, so
+    # the build gains no hard dependency — but without it the fallback is a
+    # scalar loop, which does not hold up against a library-scale gallery, and
+    # the CPU path is exactly what CI (no GPU) and the cpu builder image use.
+    find_package(PkgConfig QUIET)
+    if(PkgConfig_FOUND)
+        pkg_check_modules(OPENBLAS QUIET openblas)
+    endif()
+    if(OPENBLAS_FOUND)
+        message(STATUS "GEMM backend: CPU + OpenBLAS ${OPENBLAS_VERSION}")
+        target_compile_definitions(gemm_backend PRIVATE SAE_GEMM_CBLAS)
+        target_include_directories(gemm_backend PRIVATE ${OPENBLAS_INCLUDE_DIRS})
+        target_link_libraries(gemm_backend PRIVATE ${OPENBLAS_LINK_LIBRARIES})
+    else()
+        message(WARNING "GEMM backend: CPU scalar fallback — OpenBLAS not found. "
+                        "Correct, but slow on a large gallery (AR-027).")
+    endif()
 elseif(SAE_GEMM_BACKEND STREQUAL "CUDA")
     find_library(CUBLAS_LIB cublas
         HINTS /opt/cuda/targets/x86_64-linux/lib /opt/cuda/lib64