… step (c) (#1507)

Author additive-pure sibling of `moe_ffn_forward_layer` per
`contracts/trace-moe-gpu-sub-stages-v1.yaml` v1.1.0 step (c).

## What ships

`moe_ffn_forward_layer_with_router` returns `(output, router_top_k_weights)`:

  - `output: Vec<f32>` — `[hidden_dim]` aggregated MoE FFN output
    (the MoeFfnOut SaveTensorStage capture target).
  - `router_top_k_weights: Vec<f32>` — `[num_experts_per_tok]`
    post-softmax + renormalize top-k expert weights (the MoeRouter
    SaveTensorStage capture target).

The helper enables traced forward bodies (M-MOE-SUB-2 steps a/b
upcoming) to capture both `MoeRouter` and `MoeFfnOut` stages without a
second router computation.

## Hot path safety

Production `moe_ffn_forward_layer` is unchanged byte-for-byte. The
helper duplicates the router/softmax/top-k logic to satisfy the
v1.1.0 amendment's additive-purity invariant: "MUST NOT modify
production forward_qwen3_moe / forward_qwen3_moe_cuda hot paths".

Drift between sibling functions is mitigated by:
1. Two new unit tests asserting the helper's input-validation error
   messages match the production sibling's error class for the same
   shape/qtype boundary violations (`hidden.len() != hidden_dim` and
   `router qtype != F32`).
2. End-to-end byte-identity for realistic GGUF inputs is exercised by
   the heavy parity tests at `qwen3_moe_gpu_parity.rs` (out of scope
   for unit tests since they require the cached 17.3 GB
   Qwen3-Coder-30B-A3B-Instruct GGUF on lambda-vector RTX 4090).

## What this discharges

- FALSIFY-MOE-SUB-002 (byte-identity preservation): partial — the
  helper exists and validates inputs symmetrically with production.
  Full discharge needs M-MOE-SUB-2 steps (a)+(b) to wire it into
  traced CPU + GPU forward paths.

## Verification

  $ cargo test -p aprender-serve --release --lib gguf::qwen3_moe_load::tests
    8 passed (including 2 new helper tests)
  $ cargo clippy -p aprender-serve --lib --release -- -D warnings
    clean
  $ rustfmt --check crates/aprender-serve/src/gguf/qwen3_moe_load.rs
    clean

## What this does NOT ship

- M-MOE-SUB-2 step (a): extending `forward_qwen3_moe_traced` to call
  this helper (CPU-side traced wireup) — separate PR.
- M-MOE-SUB-2 step (b): NEW `forward_qwen3_moe_cuda_traced.rs` GPU
  sibling — separate PR.
- Real-GGUF byte-identity test — exercised end-to-end via heavy
  parity tests, not unit tests.

Refs: contracts/trace-moe-gpu-sub-stages-v1.yaml v1.1.0
      (M64 companion-spec record, aprender PR #1503)

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>