[yhirose]

Closes #10 on Metal.

What Apple GPUs do with a misaligned pointer (measured on the M1 Pro, probe kernels):

• A load or store of 4 bytes or more is right from any 4-byte-aligned address, including float4 and float2 off 16 or 8 bytes.
• From a 2-byte-aligned address it can silently move the wrong bytes (no fault). The compiler may also merge two narrower loads into such a one (two half4 loads merged into 16 bytes misread; one alone did not).
• Apple's documentation asks only that a buffer's offset be a multiple of the bound argument's element.

So f32 buffers are always safe, and only 1- and 2-byte buffers read wider than their element need a check. Metal's rule is therefore "4 bytes", not CUDA's "the vector's width", and only a handful of launchers apply it. Per-kernel declarations like CUDA's would restate those few checks, so instead:

• word_aligned_ in metal.h states the rule once. bf16_rows_vec_ uses it in place of W.off % 16 (a W on 4 bytes now takes the vectorized loader), and quant_ok_ for Q4_K's 32-bit reads. Q6_K / Q8_0 keep their 2-byte check (16-bit reads), and gemv_quant's 16-byte activation stays as CUDA's shared contract.
• The f16 prefill attention stages its cache four halves at a time without the check. It can't refuse (no composition takes an f16 cache), and it reads a cache 2 bytes off right. A test holds it to that.

Tests:

• The check_misaligned tests from 229abb7 pass on Metal (cpu / gpu / auto).
• gemm_bf16_nt and gemm_bf16_nt_f16acc must run (must_run) with A, C, or W 2 or 4 bytes off. Both backends with bf16_gemm compute any alignment, and the f16-sum op falls back to the f32 GEMM. Refusing in Metal's gemm_bf16_nt fails the A and C cases. Making word_aligned_ always true fails both W-off-4-bytes cases.
• The f16 prefill attention must run and match with the cache one half off. Staging zeros whenever the address is 2 bytes off fails it.
• Suite time is unchanged (about 2.3-2.5 s per mode).

CUDA (run on the RTX 3090, where the new f16 attention test first failed):

• b11a820: the tiled prefill attention picks its vector loads by each operand's base and widens one element at a time otherwise, so an f16 (or f32) cache off its vectors runs instead of being refused. TL_ALIGN declares only the element.
• 606fa74: the bf16 NT GEMMs declare their elements' alignment too, and check_cuda's self_guarded list is gone.
• 6634e45: DOCTEST_CONFIG_TREAT_CHAR_STAR_AS_STRING, so a failing check_misaligned logs its case name instead of an address.
• ctest 9/9 and check_cuda ALL OK on the RTX 3090.