Merge main (OWN053, #386) into feat/ownir-v1-state-protocols

main gained the OWN053 orphaned-awaitable advisory (#386) after this branch was
cut. #386 was written against OwnIR v0; this branch moves the whole contract to
v1. The merged tree is one OwnIR v1 that carries both:

    OWNIR_VERSION 1, LOWERED_VERSION 2
    flow ops      move, borrow_mut            (this branch)
    top level     orphaned_awaitables[]       (#386, additive, both strict doors)
    advisory      OWN053, two frozen families (#386)

Nothing of either side is dropped, and there is no dual-version reading.

Textual conflicts: three, all generated status documents
(docs/generated/p022-{coord-census,cp4-census,shadow-census}.md). Resolved by
regenerating them with their writer, not by picking a side.

The conflict that mattered did not conflict. Git merged
frontend/roslyn/OwnSharp.Extractor/Program.cs cleanly and left #386's new
envelope — the one that carries `orphaned_awaitables` — stamped
`ownir_version = 0`, between two envelopes stamped 1. A scan with an OWN053 site
would have produced facts the v1 core refuses at the door. The IR2 check in
tests/test_ownir.py did not see it: it read only the FIRST stamp in each
producer. It now reads every stamp (`[1, 0, 1]` fails it), and the envelope is
stamped 1.

#386's documents that mean "the current version" are migrated to it, stamp only:
tests/fixtures/verdicts/verdict_own053_orphaned_awaitable.facts.json and the
four H-29 documents under corpus/ownership-lab/h29 (promo-u and the three
malformed door inputs). Their recorded outputs are unchanged, byte for byte, on
both engines, and the merged extractor reproduces promo-u.facts.json exactly
from fx/Orphan.cs: five sites, lines 11/12/21/22/23.

Regenerated with the repository's writers: the validation ledger (294 + 50
controls = 344, the inputs now stamped by OWNIR_VERSION), the Layer 3 verdict
goldens (132 + 1 = 133 cases), the repro digests (135 + 1 = 136 documents) and
the generated status documents. The merge result differs from this branch's
previous head in exactly #386's 56 paths and from both parents in 20; no ledger
outside those moved.

T0: scripts/perf_baseline.py, the workload manifest, the three bindings, the T0
document and the merge-gate files are untouched by this merge. The harness
identity is still 1a26aa63fd5f, the value Amendment 1 recorded.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: PhysShell

corpus/ownership-lab/h29/door/README.txt

@@ -0,0 +1,16 @@
+P-OWN053-DOOR: orphaned_awaitables[] bound at both OwnIR strict doors (after the OWN053 promotion;
+prereg frozen in Own.NET-paperwork before code). Produced by the PRODUCTION build of this tree, from
+the repository root.
+
+promo-u.door.py.txt / promo-u.door.rust.txt
+    ../promotion/promo-u.facts.json through both CLIs, whose path IS the strict door: accepted,
+    5 advisory OWN053, 0 findings, exit 0, Python == Rust -- the rule and the message did not move.
+neg-garbage.facts.json      an entry whose local is a list, callee an object, result_type a number
+                            (the exact shape the unbound list rendered as a real OWN053)
+neg-line_above.facts.json   an entry with line 2147483648 (above the §4.2 domain; the unbound
+                            list degraded it to 0)
+neg-family.facts.json       an entry with family "C_whatever" (outside the closed set)
+neg-*.py.txt / neg-*.rust.txt
+    both CLIs refuse each document with exit code 2 (ordinary bad input) naming the same rule;
+    the message text differs by language, as the cp1 ledger allows (verdict + category are the
+    cross-language contract, tests/fixtures/ownir_validation.json section orphaned_awaitables).

corpus/ownership-lab/h29/door/neg-family.facts.json

@@ -0,0 +1 @@
+{"ownir_version": 1, "module": "M", "orphaned_awaitables": [{"local": "tx", "callee": "T.M/0", "file": "Q.cs", "line": 1, "family": "C_whatever"}]}

corpus/ownership-lab/h29/door/neg-family.py.txt

@@ -0,0 +1 @@
+corpus/ownership-lab/h29/door/neg-family.facts.json: error: orphaned awaitable 'family' must be one of ['A_owned_result', 'B_protocol_lifecycle'], got 'C_whatever'

corpus/ownership-lab/h29/door/neg-family.rust.txt

@@ -0,0 +1 @@
+corpus/ownership-lab/h29/door/neg-family.facts.json: error: orphaned awaitable 'family' must be one of ["A_owned_result", "B_protocol_lifecycle"], got "C_whatever"

corpus/ownership-lab/h29/door/neg-garbage.facts.json

@@ -0,0 +1 @@
+{"ownir_version": 1, "module": "M", "orphaned_awaitables": [{"local": ["what", "is", "this"], "callee": {"oops": 1}, "file": "Q.cs", "line": 119, "result_type": 12345}]}

corpus/ownership-lab/h29/door/neg-garbage.py.txt

@@ -0,0 +1 @@
+corpus/ownership-lab/h29/door/neg-garbage.facts.json: error: orphaned awaitable 'local' must be a non-empty string, got ['what', 'is', 'this']

corpus/ownership-lab/h29/door/neg-garbage.rust.txt

@@ -0,0 +1 @@
+corpus/ownership-lab/h29/door/neg-garbage.facts.json: error: orphaned awaitable: 'local' must be a non-empty string

corpus/ownership-lab/h29/door/neg-line_above.facts.json

@@ -0,0 +1 @@
+{"ownir_version": 1, "module": "M", "orphaned_awaitables": [{"local": "tx", "callee": "T.M/0", "file": "Q.cs", "line": 2147483648}]}

corpus/ownership-lab/h29/door/neg-line_above.py.txt

@@ -0,0 +1 @@
+corpus/ownership-lab/h29/door/neg-line_above.facts.json: error: orphaned awaitable 'line' must be a source line in [0, 2147483647], got 2147483648 (spec/OwnIR.md §4.2)

corpus/ownership-lab/h29/door/neg-line_above.rust.txt

@@ -0,0 +1 @@
+corpus/ownership-lab/h29/door/neg-line_above.facts.json: error: orphaned awaitable 'line' must be a source line in [0, 2147483647], got 2147483648 (spec/OwnIR.md §4.2)