fix(kyojin): Isolate JIT and runtime toolchains

Allow a pinned JIT SDK without rebuilding PyTorch or the extension.
Keep runtime device bitcode unchanged: exporting TheRock bitcode into
the serving process crashes CLR 7.2 on a basic tensor operation.

Disable unsupported expandable segments and check all five HIP kernel
modules, with an optional GPU matmul and module-loading regression test.

packages/kyojin/default.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   inputs,
+  jitRocmSdk ? null,
   ...
 }:
 # The HIP extension has to be compiled against a ROCm build of PyTorch, and the
@@ -9,4 +10,4 @@
 # ships torch 2.13, whose ROCm build fails to configure in nixpkgs and is not
 # on cache.nixos.org.
 inputs.nixpkgs-torch211.legacyPackages.${pkgs.stdenv.hostPlatform.system}.callPackage ./package.nix
-  { }
+  { inherit jitRocmSdk; }