refactor: share matcher verification

[zharinov]

This replaces the compiler and bytecode loader's parallel matcher verifiers with one representation-neutral verifier. Bytecode format, emitted instructions, generated Rust output, and runtime entrypoint selection remain unchanged. A single artifact still exposes every selectable definition and can run any of them. No caller changes are required.

Previously, each representation maintained its own graph walk for the same matcher invariants. Changes had to be implemented twice, which allowed the two acceptance paths to drift. The shared verifier now defines that contract once.

Both stages project into the same normalized Program model, with responsibility divided at these boundaries:

Owner	Responsibility
Semantic NFA adapter	Semantic limits, regex DFAs, result members, specialization targets
Bytecode loader	Raw sections, instruction decoding, offsets, entries, type metadata
Shared matcher verifier	References, return contracts, cursor depth, recursive summaries, effect and span safety

Empty-path cursor-read analysis remains a semantic-stage check because emitted targets have already passed that trust boundary. Verification failures still map to the existing SemanticVerifyError and ModuleError types.

Bytecode and generated Rust snapshots remain unchanged. A module containing two selectable definitions successfully ran either named entrypoint, and the 4,096-entry regression retained linear verification behavior.