evalv3 "field not allowed" regression with embeddings

[mvdan]

# evalv2
env CUE_EXPERIMENT=evalv3=0
exec cue export

# evalv3
env CUE_EXPERIMENT=evalv3=1
exec cue export

-- input.cue --
package p

#Image: embed: image: "foo:v1"
#JobConfig: {
	image: #Image
	job: #Job & {
		image.embed
	}
}
#Job: {
	image: string
	vcs:   "git"
	args:  [...string]
	env:   [string]: string
}

#Output: {
	_in:  _
	out:  (_in & {})
}
#Output & {
	_in: (#JobConfig & {}).job
}

As of 721ca5d:

# evalv2 (0.010s)
> env CUE_EXPERIMENT=evalv3=0
> exec cue export
[stdout]
{
    "out": {
        "image": "foo:v1",
        "vcs": "git",
        "args": [],
        "env": {}
    }
}
# evalv3 (0.029s)
> env CUE_EXPERIMENT=evalv3=1
> exec cue export
[stderr]
out.args: field not allowed:
    ./input.cue:13:2
out.env: field not allowed:
    ./input.cue:14:2
out.vcs: field not allowed:
    ./input.cue:12:2
[exit status 1]

Reduced from @nyarly's project in Unity.

[mpvl]

Here is a reduction that I'll use for debugging:

Y: {
	a: e: "foo"
	b: X & { a }
}
X: {
	e: string
	f: 1 // fails in `out`
}
#Z: {
	_in:  _
	out:  _in & __no_sharing
}
#Z & {
	_in: Y
}

Couldn't find something smaller. The __no_sharing can be dropped if structure sharing is turned off.

[mvdan]

Here is a version not resolved by https://review.gerrithub.io/c/cue-lang/cue/+/1212514:

#JobConfig: {
	image: spec: image: "someimage"
	job: #Job & {
		image.spec
	}
}
#Job: {
	image: string
	env:   "FOO"
}

#Output: {
	in: _
	out: (in & {}).input
}
out: #Output & {
	in: input: (#JobConfig & {}).job
}

[mpvl]

Closed by: https://review.gerrithub.io/c/cue-lang/cue/+/1212514