llama.cpp patches a silent rollback bug in Kimi-K3

Kimi-K3 gained speculative-decoding rollback in llama.cpp's PR #28466, and testing it exposed a state bug that had stayed hidden.

The fix matters because getting this wrong doesn't crash llama.cpp, it corrupts output silently. Without the right snapshots, a model running Kimi-K3 with rollback enabled would restore stale memory after a rejected draft, invisibly.

Speculative decoding drafts tokens ahead of the full model, then rejects the ones that don't match. For architectures with recurrent state, like Kimi-K3's KDA layers, rejecting a draft means rolling that state back too.

Kimi-K3 was added to the llm_arch_supports_rs_rollback allowlist without the storage to make that rollback safe. It only kept the model's final KDA state, not a snapshot at each rollback position. Flipping the allowlist alone, without snapshot writes, would have restored unwritten state groups with whatever was already sitting in memory after a rejected draft.

The PR saves convolution windows per rollback position along with KDA state snapshots, so a rollback restores the correct state instead of stale data.

The test note shows why the bug stayed hidden until now. Run the allowlist change alone against a zero-filled state and the split-replay check passes clean. Run it against nonzero state and it fails, off by 2.35e-6 against a 1e-7 tolerance.