feat: bin-layout for %{bin:...} deps

[Alizter]

Resolve %{bin:...} to the build artifact path (Original_path) instead of the install staging area. When %{bin:...} appears in (deps ...), a bin-layout directory is created under _build/install/<context>/.bin-layout/<digest>/ with correctly-named symlinks, and added to PATH.

The legacy staging paths (_build/install/default/bin, lib, etc.) remain on the root env for now. They cannot be removed until (deps (package ...)) provides its own scoped layout (the install-layout PR #14373), since actions using (package ...) deps still rely on the staging area for PATH and OCAMLPATH visibility.

Env binaries (from (env (binaries ...))) are excluded from the bin-layout since they already use .bin/ on PATH.

• Fixes dune build %{bin:foo} returns an error #3324
• Related: fix: resolve installed binaries to local paths #9496 (original introduction of Install_dir/Original_path)
• Depends on test: make censor disambiguate digests #14430
• Depends on test: bin pform expansion #14431

TODO before merge

• Expand the CHANGES entry to flag this as a breaking change:

  • %{bin:NAME} pform now resolves to the build artifact path (was: install staging path). Affects pforms used as string values (e.g. (echo %{bin:foo})), as run targets, and as deps.
  • argv[0] differs between (run %{bin:foo}) (build artifact path) and PATH-callable foo (bin-layout symlink basename).
  • Note: not gated by lang version. This is intentional. feat(pkg): install layouts for package sets #14373 removes the always-on staging area, so an Install_dir-gated %{bin:NAME} would point at a path that nothing builds. Flipping universally keeps the pform value coherent across the chain.

• Add a paragraph to the dune reference manual where %{bin:...} is described, explaining the new resolution target and the bin-layout on PATH for actions with %{bin:...} deps.

• Comment on Action.Full.add_env (src/dune_engine/action.ml:498) noting that env values overwrite for shared keys, so multiple PATH-prepend hints must be concat-merged with Env_path.extend_env_concat_path before calling add_env. The current convention is implicit (cram_rules.ml is the example).

Known limitations (deferred to follow-up)

• dune's sandbox does not relocate the PATH environment variable. The bin-layout dir on PATH points at the un-sandboxed _build/. This works locally because absolute paths are still readable from inside the sandbox, but would break under remote action execution. Tracked by test/blackbox-tests/test-cases/bin-pform/sandbox.t.

• Bin_layout.Key.reverse_table grows unboundedly in long-running --watch sessions (one entry per unique sorted bin set). Pattern inherited from Ppx_driver.Key. Bounded by the number of distinct bin sets the workspace evaluates; unlikely to be a real problem.

The earlier (include ...) propagation limitation is fixed by a follow-up commit between this PR and #14373 (separate PR forthcoming).

• changelog (needs expansion per TODO above)
• documentation