Integrate oneDNN matmul threadpool backend

[romirdes]

Summary

Adds an optional oneDNN matmul-primitive backend for MatMul, built against oneDNN's THREADPOOL CPU runtime so oneDNN parallelizes by calling back into gemma.cpp's existing thread pool instead of spawning its own threads.

The backend is opt-in and off by default:

• Bazel: bazel build --define gemma_onednn_matmul=1 ...
• CMake: cmake -DGEMMA_ONEDNN_MATMUL=ON ...

It is mutually exclusive with the existing BRGeMM backend (GEMMA_ONEDNN_BRGEMM), because oneDNN's CPU runtime (SEQ vs THREADPOOL) is a whole-library compile-time choice. Enabling both fails fast: a CMake FATAL_ERROR, an ambiguous select() in Bazel, and an #error guard in ops/onednn_matmul.h.

The path engages only for BF16×BF16 with M > 1 (M == 1 measured slower than stock gemma for some shapes) and falls through to the standard MatMul whenever oneDNN declines or fails, so behavior is unchanged when the flag is off.

Changes

File	Description
ops/onednn_matmul.h	New public header: build-flag guard, mutual-exclusion #error, and the threadpool adapter that lets oneDNN dispatch work onto gemma.cpp's thread pool.
ops/onednn_matmul-inl.h	New DoMatMul_OneDnn() implementation: builds/caches the matmul primitive and reordered weights, applies scale and add, returns false to decline unsupported cases.
ops/matmul-inl.h	Dispatch into the oneDNN path for BF16×BF16 with M > 1, guarded by GEMMA_ONEDNN_MATMUL, with fall-through to the existing MatMul.
ops/matmul.h	Export ops/onednn_matmul.h; add MMPerKey::onednn_built to record that the oneDNN path handled a shape.
ops/bench_matmul.cc	Exclude the first oneDNN call (JIT + weight reorder) from timings, since its cost is amortized by the primitive/weights caches; oneDNN has no autotune sweep.
util/zones.h	Add Callers::kOneDnnMatMul profiler zone.
util/zones.cc	Map the new zone to the "OneDnnMatMul" name.
BUILD.bazel	Add the gemma_onednn_matmul config setting, GEMMA_ONEDNN_MATMUL=1 define, new headers, and the @onednn_tp dependency.
MODULE.bazel	Add the @onednn_tp archive — same oneDNN v3.11 tarball/sha256 as @onednn (shared download cache), different build_file for the THREADPOOL runtime.
bazel/onednn.bzl	New shared build logic: onednn_targets(cpu_runtime) derives the runtime-dependent config lines and conditional copt from its argument.
bazel/onednn.BUILD	De-duplicated down to a single onednn_targets(cpu_runtime = "SEQ") call.
bazel/onednn_threadpool.BUILD	New build file: a single onednn_targets(cpu_runtime = "THREADPOOL") call.
CMakeLists.txt	Add the GEMMA_ONEDNN_MATMUL option, the mutual-exclusion FATAL_ERROR, and a FetchContent oneDNN v3.11 build configured with DNNL_CPU_RUNTIME=THREADPOOL.

Testing

Built and benchmarked with ops/bench_matmul under both Bazel and CMake, against the stock MatMul and the BRGeMM backend. Default (flag-off) builds are unaffected.