Modernize: switch read-only accessors from vector const& to std::span (issue #62 item 3)

[petlenz]

Item 3 of #62. Stylistic refactor: read-only accessors now return `std::span` instead of `std::vector const &`. No behaviour change.

Why std::span

• Caller doesn't have to know the container type. Today the contract says "I return you a const reference to a vector"; a future ConstitutiveModel that stores symbols in a different container (e.g. small-vector for cache locality, or a parallel arena allocator) would break callers. `std::span` exposes only "contiguous range of T" — the storage choice stays internal.
• Same zero-copy semantics as a const ref to a vector.
• Aligns with cas convention (numsim-cas `sequence.h::split_many` uses `std::span`).

What changed

`include/numsim_codegen/recipe.h` (ConstitutiveModel accessors):
```cpp
// before
[[nodiscard]] auto symbols() const -> std::vector const &;
[[nodiscard]] auto outputs() const -> std::vector const &;
[[nodiscard]] auto state_variables() const -> std::vector const &;
[[nodiscard]] auto parameters() const -> std::vector const &;
[[nodiscard]] auto inputs() const -> std::vector const &;

// after
[[nodiscard]] auto symbols() const noexcept -> std::span;
[[nodiscard]] auto outputs() const noexcept -> std::span;
[[nodiscard]] auto state_variables() const noexcept -> std::span;
[[nodiscard]] auto parameters() const noexcept -> std::span;
[[nodiscard]] auto inputs() const noexcept -> std::span;
```

`include/numsim_codegen/passes/recipe_view.h` delegates updated to match.

`` added to both headers' includes.

What didn't change

• `scalar_symbol_map` / `tensor_symbol_map` — return `std::vector<std::pair<...>> const &`. The pair element type is verbose to spell as a span template arg (`std::span<std::pair<std::string, cas::expression_holdercas::scalar_expression> const>`); skipping per the issue's note.
• `find_input_by_role` / `find_output_by_role` — return `SymbolDecl const *` / `OutputDecl const *` already; no change needed.
• Internal storage members (`m_symbols`, `m_outputs`, etc.) — still `std::vector`. Span is implicit-constructible from vector; the accessor body `return m_symbols;` works as-is.

Verification

135/135 tests pass. No new tests — every consumer iterates the returned range, which span supports identically. Existing call sites in:

• `tests/PassFrameworkTest.cpp` (RecipeView delegate tests)
• `tests/StateVariableTest.cpp` (symbol indexing tests)
• `src/targets/standalone_cxx.cpp` (backend code)
• `src/targets/moose_material.cpp` (backend code)
• `include/numsim_codegen/recipe.h` (`render_compute_function`, `detail::tensor_arg_count`, `SymbolValidationPass::run`, `TensorSpaceConsistencyPass::run`, `CodeEmitPass::run`)

all use range-based for or index-based access, both of which work identically on `std::span` and `std::vector const &`.

Migration notes for downstream users

The only breaking change is type-explicit code:
```cpp
// breaks:
std::vector const &syms = model.symbols();

// works:
auto syms = model.symbols(); // span
auto const &syms = model.symbols(); // span (extra const harmless)
for (auto const &s : model.symbols()) ... // unchanged
```

We have no downstream users today; this is the right time for the migration.

Stack

`main ← this`. Independent of PRs #63 (std::format) and the still-to-be-opened std::expected PR.

[petlenz]

Pre-merge fixup (commit 404393f) addresses review:

• M1 — invalidation warning comment added to parameters() and inputs() accessors. Phase 2 mutating passes that add_* mid-pipeline must re-acquire the span.
• m4 — noexcept added to all three RecipeView delegate declarations + definitions to match the underlying ConstitutiveModel accessor specs.

m3 deliberately deferred: CodeGenContext::statements() returns std::vector<Statement> const & and was NOT converted in this PR. It's on the same conceptual axis as the converted accessors but lives in the code-emit layer (consumed only inside render_compute_function). Out of scope for this PR's stated ConstitutiveModel/RecipeView surface. Filing a follow-up issue if you want it converted.

135/135 tests still pass.

[petlenz]

Second-pass review fixup (commit e5d7f83): addresses cpp-pro's Major from REVIEW-pr-62-round2.md — static_asserts in RecipeView lock the noexcept-variant invariant into the type system. Without them, a future refactor that introduces a potentially-throwing assignment to m_model would make the noexcept delegate declarations a silent std::terminate hazard at runtime. Now machine-checked.

Earlier fixup (commit 404393f) addresses round-1 M1 (span-invalidation comment on parameters()/inputs()) + m4 (noexcept on RecipeView delegates).

m3 (CodeGenContext::statements() unconverted) deliberately deferred — out of this PR's stated ConstitutiveModel/RecipeView scope.

CI green; 135/135 tests.