Tighten IR construction and replay boundaries

[wangxiao1254]

Summary

Tighten IR construction, persistence, scheduling, composition, session boundaries, and replay lifetimes while keeping trusted circuit code as the execution model.

Checks are concentrated at compile, load, raw-plan, and session boundaries; scalar, scheduled, and SIMD gate loops do not gain structural validation scans.

Changes

Frontend contracts

• require positive-width WireBundle values and width-preserving context rebinding;
• make explicit-context bodies accept Ctx&;
• align live invocation value categories with compiled invocation;
• check argument/result context ownership at frontend boundaries;
• improve compile-time diagnostics for malformed callables and value families.

Program identity and validation

• distinguish streamed gate digests from versioned full-program fingerprints;
• validate dense numbering and Linear/Full wire-reuse invariants;
• validate .empbc framing, reserved bytes, count narrowing, and write completion;
• validate builtin circuit signatures before caching/replay;
• validate artifact signature widths and checked input accumulation;
• make analysis and layout passes own their liveness inputs.

Prepared execution

• pair each dense program with its precomputed schedule in ScheduledProgram;
• expose reusable workspaces for scheduled and SIMD replay;
• keep one-shot convenience APIs while making prepared replay explicit.

Composition and chunked sessions

• co-own referenced units in ComposePlan;
• validate event order, instance wiring, dense wire IDs, counts, and flattened-size arithmetic;
• reject malformed flush streams, duplicate producers, stale operands, and narrowing;
• validate chunked reveal widths and raw-artifact shape boundaries.

Lifetimes and compaction

• release context-bound wires retained by thread-local float replay workspaces;
• reject recorder teardown while wires remain live;
• validate ClearSession context ownership and runtime codecs;
• recycle dead-on-arrival compacted results while preserving Linear AND slots.

Source compatibility

• DigestCtx::digest becomes DigestCtx::value();
• digest_gate_stream() is the trace identity; digest_program() is the full structural identity;
• scheduled replay uses ScheduledProgram rather than a separately mutable plan;
• frontend boundary bundles require positive static width;
• explicit-context circuit bodies take a mutable context lvalue reference.

Tests

• clean Apple Clang 17 Release/Ninja build: 98/98 build steps;
• full CTest suite: 76/76 passed;
• focused IR suite: 12/12 passed, covering program validation, passes, analysis, transform, composition, contexts, session concepts, chunk recording/session replay, dynamic values, builtin circuits, and SIMD replay.

The suite covers compile-time frontend contracts, malformed programs/artifacts/files/plans, prepared schedule/SIMD replay, composition, chunk recording and reveal boundaries, float workspace lifetime, ClearSession ownership, dense validation, and compaction equivalence.

Stack

This is PR 5 of 6 and targets audit/crypto-foundations.