IR-295: source-bind Kani form settlement

[kreneskyp]

Refs IR-295

This change source-binds Kani form settlement to typed IR forms before capability negotiation reports Supported. It gives V2 function applications stable refusal identities and verifies the source callee plus ordered arguments. The function generator receives body-expression roots and call-item roots from one admitted ContractPackageV1; source declaration IDs remain distinct for exact call binding.

Current head: 6618b8c062977064a06ae18679304c3d5573703f, based on main 6531d982ff432a28545a872d29fe3ef53ff04eb6.

Focused receipts on this candidate:

• All 11 integration selectors that failed in the earlier pair-1 run pass 1/1 after the fixture and classifier corrections.
• AC-1 no-cascade/Add control: PASS (1/1).
• Generated-function/direct-runtime agreement: PASS (1/1).
• Corrected ambiguous-name/location-map selector using a distinct Boolean equality root: PASS (1/1).
• cargo fmt --all -- --check: PASS.
• git diff --check: PASS.

Combined focused log: /tmp/ir295-pr354-13-focused-cb0f474-final.log; corrected ambiguity retest: /tmp/ir295-pr354-ambiguous-e_tuple-cb0f474.log. Commands used QSPEC_DIR=/home/peter/dev/quire-specification, CARGO_HOME=/tmp/ir295-pr354-cargo-home, and target /home/peter/dev/quire-contract-codegen-ir295-pr354/target/ir295-pr354-clean-cb0f474.

The ordinary corpus now gives scalar roots a checked quire.op.integer.add operation and Integer result; FN_EQ remains an equality root and call roots retain their existing form. This preserves the 14-application-root construction and its admission/accounting assertions. The resolved canonical ext-corpus package measures 264,645 bytes, below the 1 MiB reader cap. The prior 156,857-byte figure was stale and is superseded by this measured value. No cap or acceptance assertion was weakened.

AC-11 retains typed Model/State lowering-family blockers and valid V2 source calls. AC-27 source-binding checks remain separate, including body-root/declaration-ID distinction, wrong-callee discrimination, and ordered arguments. The scalar body classifier now checks its declared arithmetic operator against the checked operation identity and returns BodyMismatch on disagreement.

The obsolete MAX_CALL_DEPTH chain selector and generated chain fixture were removed. AC-7 coverage is the flat 100K-call SSA schedule test only. AC-34 remains Planned; this PR claims neither AC-34 nor runtime call-depth coverage.

Reviewer artifacts are committed at this head: code review and gap analysis. FND-003 and FND-004 are fixed; the latest delta review records FND-005 and FND-006 fixed with no new findings.

Aggregate gate history: Pair 1 make -k ci was red on pre-fix head cb0f47414afa6137fce86cbabd5e929eb903648f (exit 2), log /tmp/ir295-pr354-clean-ci-cb0f474.log. MSRV and regular integration runs each reported the same 11 failures (517 passed, 11 failed, 27 ignored); AC-7 flat 100K and AC-34 strict-reader chain passed in those runs. The focused fixes above are green, but aggregate CI has not been rerun on this head. Kani was skipped because CI was red and has not run on this head. Both aggregate CI and Kani remain pending.