feat(core): checked frontend contracts, embedding hosts and persistent REPL state

[fffonion]

Summary

Consolidates former #34 into this Core PR, retaining separate coherent scope commits:

1. Checked language-neutral frontend contracts: catalog/link admission, logical schemas, strict ownership and native analysis diagnostics; retired frontend-specific Core compatibility paths.
2. Embedding-owned CLI hosts and checked REPL modules across source, REPL, debug/record and artifacts, preserving existing callers.
3. Persistent REPL root bindings, checked session schemas, allocation/remapping and result precision.
4. Opt-in bounded callable weak-identity maintenance without changing live identity or ownership behavior.
5. Source-bound compiler-certified direct Move Resource capture facts and weak actual capture-cell root observation.
6. Producer-policy partitioning and private root-origin preservation through availability/liveness rewrites, closing the mixed-module certification P1.

Candidate and contracts

Base remains master; candidate head is a6863bc33da37f06f271ba6766993b3b26c6968a. The first four accepted scope commits remain unchanged through 7e5566bcc1a65f7b158867ee75cf509677cd1ed4; capture commits are 2ae845fd04fbf1f6b9d336b16e731971ee6f59ec and its correction a6863bc.

No TypeScript-specific Core implementation, new Value/schema variant, ordinary array ownership change, builtin-ID reassignment, VMBC/native/AOT version change, or required public field/plugin method is introduced. VMBC 13, native callable ABI 7 and artifact version/ABI 8 remain unchanged. Foreign/stale rejection, complete typed resource handles and resource ownership remain enforced.

Capture authority comes from the declaration/creation producer's resolved ownership policy, with missing linked metadata failing closed. Enabled dependencies beneath disabled entries retain authority; disabled dependencies execute normally without certification. Root statement origins survive inserted statements/Drops while retaining whole-block backwards liveness and cross-source last-use ordering. Standalone producer identity remains private and does not replace diagnostic source names.

Certification is bound to compiler-issued program/prototype/capture facts and actual cell validity. Weak cell observation introduces no durable strong resource/environment roots. Existing source-owned execution is covered; old persisted VMBC/AOT capture queries remain Unavailable, while ordinary artifact execution and explicit cleanup continue unchanged.

Verification and review

• Exact final candidate default workspace parallel and serial: each 2337 passed, 13 ignored, 0 failed, with the same 2350 qualified identities/statuses.
• Passes comprise 2319 business cases, 15 helper-reference cases, two trybuild outer cases and one external-fixture outer case. Nested 16 UI fixtures and nine external tests are recorded separately.
• Final source-bound fmt/check/strict Clippy/preflight, focused feature/native/external checks pass. Nineteen final receipts bind exact clean candidate HEAD, allocation environment, raw results and before/after source; historical RED/intermediate failures are retained separately, and zero-executed filters are excluded from proof.
• Public capture target 13 passes; root controls 15; root provenance control one. Real native trace/source-AOT/legacy-artifact execution and bounded metadata controls remain covered by the actual receipts.
• Root regression preserves dependency closure identity after 7/7 statements/origins become 15/15. Four ordinary BASE/current VMBC pairs are byte-identical.
• Independent scoped review is CLEAN, closing the mixed-producer P1. Combined with the earlier unchanged-part review, it accepts the capture producer. Earlier four-scope whole-change review remains accepted, including its existing nonblocking static-cost note.

New exact-head CI for a6863bc33da37f06f271ba6766993b3b26c6968a passed: push run 38370349670 and PR run 38370356443, all 12 jobs successful, including Linux/macOS/Windows CLI builds, Rust lint/tests and the VS Code/wasm build checks. The remote branch and PR head were re-read at this exact candidate. Previous 7e5566b CI remains historical foundation evidence. The Core producer publication/CI dependency is satisfied; the active companion scalar correction remains separate and must be accepted before the next sequential consumer integration.

This PR does not claim downstream TypeScript algorithm completion, transparent-array owner/lifetime acceptance, automatic resource reclamation, generators or certification of old persisted artifacts. Companion frontend integration remains in its separate repository.