Function env_require_gpu 

pub fn env_require_gpu() -> bool

True when KEYHOG_REQUIRE_GPU=1 is set: the operator demands a usable GPU and a silent CPU fallback is forbidden. Read uncached so embedders / tests that toggle the var between scans see the change (it is process- global at runtime, so this is only a few extra syscalls on the cold path).