engine: add proptest for XMILE macro round-trip and extract/reconstruct idempotence invariants

[bpowers]

Summary

Add a property-based test (proptest) over randomly-generated single-output and multi-output macro projects asserting two round-trip invariants for the XMILE macro support. This is purely additive test strengthening recommended during the Phase 5 code review of the Vensim macro support work (XMILE import/export). The reviewer explicitly said "Track as tech-debt if not done now."

There is no known defect -- the existing example-based tests pass. This is about strengthening confidence in the round-trip/idempotence properties and catching edge cases the hand-built examples miss.

Invariants to assert

1. Reader-produced to_xmile fixed-point property: for a reader-produced (canonically-ordered) datamodel::Project, to_xmile is byte-stable across a re-parse, i.e. open_xmile -> to_xmile -> open_xmile -> to_xmile yields byte-identical output.
2. extract_macro_invocations ∘ reconstruct_macro_invocation is the identity on Phase-4-materialized multi-output macro clusters: extract ∘ reconstruct == identity, and reconstruct ∘ extract == identity on the materialized datamodel shape.

Why it matters

Current Phase 5 coverage of these XMILE macro round-trip invariants is example-based: a handful of hand-built and fixture cases (macro_expression, macro_multi_expression, macro_multi_macros, macro_stock, plus unit round-trip tests). A proptest over generated macro projects would materially strengthen confidence in the round-trip/idempotence properties and catch edge cases the examples miss -- varied parameter counts, additional-output counts, body shapes, and aliased bindings. This improves long-term maintainability and regression safety of the macro read/write paths without changing behavior.

Components affected

• src/simlin-engine/src/xmile/mod.rs and src/simlin-engine/src/xmile/model.rs (the macro read/write + extract/reconstruct paths).
• The new proptest would live in the xmile test surface. The engine already uses proptest elsewhere (e.g. src/simlin-engine/src/json_proptest.rs), which can serve as a pattern reference for generator strategies and shrinking.

Possible approach

• Build proptest Strategy generators for single-output and multi-output macro projects (varying parameter counts, additional-output counts, body shapes, and aliased bindings), analogous to the existing JSON proptest strategies.
• For invariant (1), drive a generated/reader-produced canonical datamodel::Project through the open_xmile -> to_xmile -> open_xmile -> to_xmile pipeline and assert byte equality of the two to_xmile outputs.
• For invariant (2), generate Phase-4-materialized multi-output macro clusters and assert extract ∘ reconstruct and reconstruct ∘ extract are identities on the respective shapes.

Context

Identified during the Phase 5 code review of the Vensim macro support work (XMILE import/export). Reviewer-recommended future test enhancement; explicitly deemed out of scope for the Phase 5 implementation itself. Relate to the macros epic (docs/implementation-plans/2026-05-13-macros/) as a post-implementation test-hardening follow-up.