codegen: namespace ancillary types under buffa_:: sentinel + per-package stitcher

[rpb-ant]

Summary

Ancillary types emitted by buffa-codegen — view structs, oneof enums, oneof view enums, extension consts, and register_types — currently share the package-level Rust namespace with user proto types. Suffix-based disambiguation (FooView, KindOneof) handles most cases but still rejects pathological inputs (message FooView next to message Foo; nested type literally named {X}Oneof next to oneof {x}) with a codegen error.

This PR moves all ancillary kinds under a single reserved sentinel module __buffa:: per package, making collisions structurally impossible without name mangling, and has codegen emit a per-package <pkg>.mod.rs stitcher so consumers integrate via one buffa::include_proto!("pkg") call instead of hand-authoring the module wrapper.

Supersedes #54 and #37. Closes #32.

Layout

Item	Before	After
Owned message	pkg::Foo	pkg::Foo (unchanged)
View struct	pkg::FooView	pkg::__buffa::view::FooView
Nested view	pkg::foo::BarView	pkg::__buffa::view::foo::BarView
Oneof enum	pkg::foo::KindOneof	pkg::__buffa::oneof::foo::Kind
View-of-oneof	pkg::foo::KindOneofView	pkg::__buffa::view::oneof::foo::Kind
Extension const	pkg::FOO	pkg::__buffa::ext::FOO
Registration fn	pkg::register_types (per file)	pkg::__buffa::register_types (per package)

The sentinel __buffa is the only name codegen reserves in user namespace. It aligns with the existing __buffa_ reserved-field-name prefix (__buffa_cached_size, __buffa_unknown_fields), so the rule is uniformly "anything starting __buffa is reserved." validate_file errors with CodeGenError::ReservedModuleName if any proto package segment, message, or file-level enum would produce a __buffa-named module/type. Adding future ancillary kinds nests them under the existing sentinel; no new reserved words.

No convenience re-exports. Short-path aliases (pub use __buffa::view::*) are intentionally not emitted — they would work in the common case but silently change meaning when a user proto shadows them. The canonical __buffa:: path is unconditional.

Per-package .mod.rs stitcher

Codegen now emits, in addition to the five per-proto content files (<stem>.rs, <stem>.__view.rs, <stem>.__oneof.rs, <stem>.__view_oneof.rs, <stem>.__ext.rs), one <dotted.pkg>.mod.rs per package containing the pub mod __buffa { … } wrapper and a single merged register_types body. Consumers reference only the stitcher:

pub mod my_pkg {
    buffa::include_proto!("my.pkg");  // → include!(OUT_DIR/my.pkg.mod.rs)
}

Per-proto content files remain 1:1 with input protos (split-invocation safe for build systems that compile package subsets independently). The stitcher is the only per-package artifact and has the same caveat as any generated include file.

This collapses the wrapper-authoring previously duplicated across buffa-build, buffa-types, buffa-test, conformance, examples, benchmarks, gen_lib_rs.py, and protoc-gen-buffa-packaging to one place in codegen (the canonical ALLOW_LINTS list lives there too). buffa-build::generate_include_file now delegates to buffa_codegen::generate_module_tree.

register_types per-package

Because the stitcher is per-package, register_types is naturally one fn per package. The emit_register_fn=false workaround in gen_wkt_types.rs (seven WKT files × one fn each colliding in google.protobuf) is no longer needed.

Deleted

• CodeGenError::OneofNameConflict and ::ViewNameConflict — collisions are structurally impossible.
• proto_path_to_rust_module is #[deprecated] (consumers should use the stitcher path); follow-up will remove it.

Test plan

• task lint — fmt + clippy clean (verified against rustc 1.95)
• task lint-md — markdownlint clean
• task test — 1462 tests pass
• task verify — 6× CONFORMANCE SUITE PASSED, baseline numbers exact
• task stress-googleapis — 47 protos compile clean
• examples (addressbook/envelope/logging), benchmarks — compile clean
• regression tests for message View { message Inner {} } (codegen unit + prelude_shadow.proto end-to-end) and package foo.view;
• reservation tests for package foo.__buffa;, message __Buffa {}, and enum __buffa {}

Breaking changes

API-breaking for downstream consumers of generated code (import paths for views, oneofs, extensions, register_types). Migration is mechanical per the layout table above. Pre-1.0.

[iainmcgin]

[claude code] Renamed the sentinel from buffa_ to __buffa per DM agreement — aligns with the existing __buffa_ reserved-field-prefix convention so the rule stays "anything starting __buffa is ours." The rename was a one-line constant change (SENTINEL_MOD in context.rs); the rest is consumer paths and regen.

Also added two regression tests for the collision cases this PR fixes: generation.rs::test_child_package_named_view_no_collision (package foo + package foo.view) and message View { message Inner } in prelude_shadow.proto for end-to-end compilation. The four sentinel-reservation tests in naming.rs were already here — adapted in place.

I'll close #54 once this lands.

[iainmcgin]

[claude code] Reviewed: sentinel rename clean (single SENTINEL_MOD constant), validator covers package segments / messages / file-level enums with the right snake-case vs verbatim split, regression tests cover both collision repros end-to-end. Per-package .mod.rs stitcher + include_proto! macro + canonical ALLOW_LINTS eliminates the wrapper duplication. CI green at 4bd7a6a.