Invoke a mask callable exactly once

[cemde]

Bug

_process_mask discovered whether a mask callable accepts the is_pytree hint by calling it and catching the failure:

try:
    return mask(kwarg, is_pytree=True)
except TypeError:
    return mask(kwarg)

except TypeError cannot distinguish "this callable does not accept is_pytree" from "this callable ran and raised TypeError for its own reasons".

Impact

A genuinely broken mask executes twice. The user sees the second failure with the first chained onto it, and the traceback points at _process_mask rather than at their own code. Any side effect in the callable happens twice.

It also hid real bugs. Reviewing #68 found that a broken _M_not was silently degraded to the one-argument path by this fallback rather than surfacing.

Fix

Ask the signature instead of inferring from a failure:

if "is_pytree" in inspect.signature(mask).parameters:
    return mask(kwarg, is_pytree=True)
else:
    return mask(kwarg)

The mask is now invoked exactly once, and any error it raises propagates from the user's own frame, unchained. inspect was already imported in this file for _repr_function, so the diff adds no dependency.

Why not a narrower except

Telling the arity TypeError apart from a user's own would mean matching on the exception message text, which is wording-dependent across Python versions and no smaller than this.

Cost

inspect.signature runs once per callable mask leaf, not per parameter. Measured: +13 µs on _process_mask, which is 0.24% of one eager training step and inside run-to-run noise. Under pxf.jit, how every tutorial spells the step, it runs once per trace rather than per step. No caching warranted.

Closes #78