fix: adopt ns-cmsis-nn 7.41.0 and cover s16 quantization

[apage224]

Adopt ns-cmsis-nn v7.41.0 so the registered INT16-to-INT16 QUANTIZE consumer receives the released saturation repair. Make, workflow defaults, external source contracts, CMSIS-Pack requirements and current integration guides use the containing release. The pack derives its minimum from the selected source root’s compiled HELIA guard. The checker uses the archive’s packaged guard for .pack files, or matching staged sources/an explicit --repo-root for plain PDSC files; it rejects stale advertised metadata without trusting the tool checkout’s floor and requires exactly one descriptor and one canonical guard ZIP entry.

Carry the existing N1/N9/N5 saturation, ordinary-scale and canary regression with real CORE-call checks, plus the existing convolution-status fixture adaptation for provider-internal size queries. Production RT kernels, packing and dispatch remain unchanged; AD FP16 remains the standard nonpacked route. CORE #737 and #734 are absent from this release.

Validation: local released-source ATfE 22.1.0 M55/MVE QUANTIZE 3/3 and convolution-status 24/24; M4-target non-MVE QUANTIZE 3/3 on compatible Cortex-M55 FVP. Large-shift N1/N9 select the scalar-wide fallback; ordinary N5 selects the MVE body/tail by released-source routing. The metadata correction reuses these unchanged runtime inputs and adds focused metadata regressions for current/old advertised floors, two selected source roots, explicit/staged PDSC context and packaged guards. The selected-root check fails against the prior correction and passes after; lower tool-root metadata is rejected. Actual generated PDSC/manifests/example floors agree on 7.41.0; old saved PDSC is rejected. These checks do not establish physical M4 qualification or application task quality. The ordinary Tests, CMake smoke and docs workflows passed at this head. Matched KWS, AD native FP16, ResNet A16W8 and full VWW A16W8 cold/warm diagnostics also completed on Apollo510B at 96 MHz using the same ATfE 22.1 production assembly, compiler flags and SRAM-arena/MRAM-model placement on both sides. Every baseline/candidate phase output was byte-exact, and all whole-model median increases were below 1%; the largest was ResNet warm, 87.620458 to 87.961427 ms (+0.340969 ms / +0.389143%). Runtime guards and allocation checks passed; stack high-water and executed mathematical-leaf attribution were not measured. AD remains the standard nonpacked FP16 route, and its unchanged stored-reference discrepancy is nonauthoritative for task quality.

VWW softmax has two retained operator-phase flags: cold 6.281250 to 6.750000 microseconds (+0.468750 microseconds / +7.462687%), and warm 6.489583 to 6.750000 microseconds (+0.260417 microseconds / +4.012841%). All other positive measured costs remain in the complete evidence table. Historical 49 flags plus one separate repeat cover different model hashes, providers and configurations; they remain broader-portfolio warnings rather than established losses at this head. The four fixed-input diagnostics do not qualify that broader portfolio or a labeled task-quality criterion. No universal correctness or speedup claim follows.

The archive reader rejects multiple descriptors and duplicate/missing canonical guards before reading metadata; duplicate filenames count as separate entries. One focused metadata run passed all eight checks, including entry-order and duplicate-name negatives.

BUG=426
Refs #426
Refs #427