Guard against running the tiny oracle against a real model (#76)

The default ./glm mode validates against ref_glm.json, which is generated
from glm_tiny (a random tiny model). Pointed at the 744B GLM-5.2 it feeds
the model tiny-vocab prompt tokens and compares against tiny references —
0/20 and a degenerate loop, guaranteed on EVERY platform (x86/ARM/Metal),
which reads as an engine bug (it isn't). Detect the mismatch (real vocab +
tiny-range oracle ids) and print the correct commands instead. REF_FORCE=1
overrides. The engine self-test (SNAP=./glm_tiny TF=1) is unaffected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

c/glm.c

@@ -2611,6 +2611,17 @@ int main(int argc, char **argv){
     char *ar=NULL; jval *ref=json_parse(b,&ar);
     int np,nfull; int *prompt=read_arr(ref,"prompt_ids",&np); int *full=read_arr(ref,"full_ids",&nfull);
     int n_new=nfull-np;
+    /* L'oracolo (ref_glm.json in repo) e' del modello TINY: contro il 744B da' 0/20
+     * garantito su OGNI piattaforma (prompt-token tiny = spazzatura per il modello vero).
+     * Non e' un bug del motore — vedi #76. */
+    { int maxid=0; for(int i=0;i<nfull;i++) if(full[i]>maxid) maxid=full[i];
+      if(m.c.vocab>1000 && maxid<1000 && !getenv("REF_FORCE")){
+        fprintf(stderr,"ERRORE: ref_glm.json e' l'oracolo del modello TINY (token max %d, ma il tuo vocab e' %d).\n"
+                       "        Self-test motore:  SNAP=./glm_tiny TF=1 ./glm 64 16 16   (atteso 32/32)\n"
+                       "        Prova reale:       PROMPT=\"Ciao\" NGEN=32 SNAP=<modello> ./glm 64\n"
+                       "        REF_FORCE=1 per eseguire comunque il confronto (senza senso).\n", maxid, m.c.vocab);
+        return 1;
+      } }
 
     if(getenv("REPLAY")){
         run_replay(&m,full,nfull,np);