common/hexutil: hex encode/decode in simd - #24410

Kernel verified: I built the head with go1.27.1 + GOEXPERIMENT=jsonv2,simd for amd64 and ran it under Rosetta 2 (which reports AVX2): common/hexutil passes, also with -race and with GODEBUG=cpu.avx2=off; rpc/jsonstream, common and execution/types pass too. Four hand-made kernel mutants (table digit, nibble mask, shift width, dst stride) all fail TestEncodeHexMatchesStdlib. The vector loop has no bounds checks in the disassembly, as the commit says. No correctness issue.

Two things I'd like fixed before merge, one small regression, and a few notes.

1. encodeHex returns with dirty YMM upper halves (no VZEROUPPER)

go1.27.1 does not emit VZEROUPPER for archsimd code (checked with objdump), and archsimd.ClearAVXUpperBits exists for exactly this; every AVX2 routine in the Go runtime and bytealg ends with VZEROUPPER for the same reason. After encodeHex the rest of the request runs legacy-SSE code (memmove, MOVUPS copies). On Skylake and later each SSE register write pays a merge µop with a false dependency until the next VZEROUPPER, which in practice is the next memmove over 256 bytes; on Haswell/Broadwell it is a ~70-cycle state transition each way, more than the ~15 ns the kernel saves per hash. AMD has no penalty, which is why the Zen 4 numbers don't show it. Suggested shape (tested; one extra instruction after the loop, and short inputs no longer touch YMM at all):

	if hasAVX2 && len(src) >= 16 {
		digits := archsimd.LoadUint8x32Array(&hexDigits32)
		low := archsimd.BroadcastUint16x16(0x0f)
		for len(src) >= 16 && len(dst) >= 32 {
			...
		}
		archsimd.ClearAVXUpperBits()
	}
	hex.Encode(dst, src)

#24411 and #24418 have the same gap.

2. test-simd.yml as a required merge-queue leaf

It becomes a required ci-gate job, but skips everything setup-erigon does to keep module fetching deterministic: cache: false with no replacement, so every run downloads 32 modules (see the job log), no GOPROXY=https://proxy.golang.org|direct fallback and no retry loop. That is a new flake vector in the merge queue, which CI-GUIDELINES asks to keep free of false positives. It also lacks the "Cancel workflow run on failure" step (and the actions: write permission it needs) that the other leaves use to fast-evict a broken PR, and it runs an inline go test with no Makefile equivalent.

Suggestion: add an optional go-version input to setup-erigon (default stays the go.mod minor) and use it here, so the job inherits the mod cache, proxy fallback, retries and cache keys; register it in cache-warming.yml like test-bench; add a make test-simd target with GOEXPERIMENT=jsonv2,simd that the workflow calls. When #24411/#24418 land the package list needs extending; deriving it from grep -rl goexperiment.simd --include='*.go' would keep it in one place.

3. Default build: Encode / MarshalText are slower for small inputs

Bytes(b).AppendText(nil) goes through slices.Grow(nil, …) → growslice, while the old make([]byte, n) is stack-allocated for n ≤ 32 on Go ≥ 1.25 and cheaper than growslice above that. Default build (arm64, go1.27.1, -cpu 1, n=8), main → this PR: Encode 4/8/15 B: 21.5→35.5 ns, 23.6→38.6 ns, 28.4→45.1 ns (1→2 allocs); Encode 20/32 B: +6%; MarshalText 4–15 B: +23–28%, 20/32 B: +16%/+10%; ≥64 B unchanged. AppendText/AppendQuoted (the RPC path) are unchanged. Keeping make in MarshalText and sharing the prefix write brings both back to main or slightly better (measured):

func (b Bytes) MarshalText() ([]byte, error) {
	result := make([]byte, len(HexPrefix)+2*len(b))
	writeHex(result, b)
	return result, nil
}

func (b Bytes) AppendText(dst []byte) ([]byte, error) {
	n, size := len(dst), len(HexPrefix)+2*len(b)
	dst = slices.Grow(dst, size)[:n+size]
	writeHex(dst[n:], b)
	return dst, nil
}

func writeHex(dst, b []byte) {
	dst[0], dst[1] = '0', 'x'
	encodeHex(dst[2:], b)
}

func Encode(b []byte) string {
	enc, _ := Bytes(b).MarshalText()
	return string(enc)
}

Notes, non-blocking

• As merged, no shipped binary gets the kernel: the Makefile sets GOEXPERIMENT ?= jsonv2 and the Dockerfile builds through make, so the RPC numbers in the description only apply to GOEXPERIMENT=jsonv2,simd builds. Worth one sentence in the description (and the ChangeLog, if it gets an entry) so nobody expects them from a release.
• TestEncodeHexMatchesStdlib passes on a runner without AVX2 without ever running the kernel. A require.True(t, hasAVX2) in encode_simd_test.go when CI is set would make that visible.
• Description typo: the package is simd/archsimd, not simd/simdarch.