Close the remaining accepted first-release static-boundary gaps.

[kleeedolinux]

Summary

Close the remaining accepted first-release static-boundary gaps.

This change:

• completes typed FFI record layouts, callbacks, transition handling, and
  deterministic .popc binding generation;
• verifies generated FFI source and callback metadata before compilation;
• adds checked nominal interface-to-class casts;
• propagates exact effects through direct, indirect, interface, and iterator
  calls;
• enforces compiler-proven Text.View and Bytes.View lifetimes;
• generates typed retained-metadata adapters using a closed codec protocol;
• implements the contracts in canonical MIR, the MIR interpreter, LLVM, and
  the native runtime;
• keeps the experimental C backend fail-closed for unsupported callbacks and
  views;
• localizes the new diagnostics and CLI failure paths;
• marks the first-release roadmap gap complete.

Architecture traceability

• Authorizing architecture section or ADR:
  • ADR 0022: Explicit Effects, Failures, and GC Operations in Portable IR
  • ADR 0092: Typed FFI Callbacks and Native Transition ABI
  • ADR 0093: Deterministic FFI Binding Generation
  • ADR 0094: Generated FFI Callback-Pair Metadata
  • ADR 0095: Checked Interface-to-Class Casts
  • ADR 0096: Generated Retained-Metadata Adapters
  • ADR 0097: Compiler-Proven Text and Bytes Views
• New or changed public contract:
  • typed FFI callback and by-value record contracts;
  • canonical .popc generated-binding and retained-metadata descriptors;
  • checked nominal casts;
  • exact callable effect summaries;
  • compiler-proven borrowed view lifetimes;
  • generated typed codec adapters.
• Architecture documents, examples, or terminology updated:
  • ADRs 0092–0097 and their integrated architecture references;
  • closed design decisions, conformance material, diagnostics, and examples;
  • ROADMAP.md.

Verification

• Tests were added or updated before implementation where behavior changed.
• Positive behavior is covered.
• Negative/rejection boundaries are covered.
• Convention, consistency, and regression coverage is present where relevant.
• Cross-backend or differential coverage is present where relevant.
• cargo fmt --all -- --check
• cargo check --workspace --all-targets
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings

If a check was not run, explain why:

The complete workspace-wide test and Clippy commands were not run. The full
driver suite, native runtime suite, and architecture-regression suite passed,
including the FFI, casts, effects, views, retained-metadata, interpreter, LLVM,
and fail-closed C coverage affected by this change.

Review notes

• No dynamic typing, runtime string lookup, broad reflection, or universal-table behavior was introduced.
• HIR/MIR remain backend-neutral.
• No generated artifacts, dependency caches, credentials, or editor files are included.
• This is ready for technical review.

The experimental C backend deliberately rejects unsupported callback and view
operations. It is not treated as a parity target for this release.

---

Summary by cubic

Closes the remaining first-release static-boundary gaps by adding typed FFI callbacks/layouts, deterministic/verified .popc bindings, checked interface→class casts, compiler‑proven Text.View/Bytes.View, exact retention/provenance summaries, and generated codec adapters across MIR, LLVM, and the runtime; the experimental C backend fails closed for unsupported features.

• New Features

  • Deterministic FFI generation from canonical .popc with pre-build verification; by‑value record marshalling and schema‑2 callback pairs with fixed LLVM thunks and MIR‑interp support.
  • Exact FFI transition checks and adapter install/uninstall; no dynamic lookup; fail‑closed C backend for callbacks, views, casts, and codec ops.
  • Checked nominal casts using target-type calls (e.g., FileReader(reader)) returning Class?, with focused diagnostics.
  • Compiler‑proven Text.View/Bytes.View: non‑allocating views with MIR ops, LLVM lowering, interpreter support, and escape/suspension diagnostics.
  • Refined callable summaries: per‑parameter retention and per‑result provenance enforced across direct/indirect/interface/iterator calls.
  • Generated codec adapters for @RetainMetadata(use = Metadata.Use.Codec): canonical retained-adapters.popc as the source of truth and a sibling Codec.Schema<T> Item resolved at compile time.

• Migration

  • Add [platform."<triple>".ffiGenerators] entries and run pop ffi generate --manifestPath <bubble.toml> --platformTarget <triple>; commit bindings.pop, native-bindings.popc, and any shim C unit. Builds now verify these before compilation.
  • Use @RetainMetadata(use = Metadata.Use.Codec, schemaVersion = 1) on eligible types and reference the generated Codec.Schema<T> (e.g., UserSchema); artifacts now include retained-adapters.popc.
  • Replace downcasts with target‑type calls (e.g., ClassName(value)) and handle the optional result.
  • Ensure Text.View/Bytes.View do not escape their lender or cross suspension; materialize with Text.toString/Bytes.toBytes if a longer lifetime is needed.
  • Use the LLVM backend or MIR interpreter for FFI callbacks and views; the experimental C backend deliberately rejects them.

^{Written for commit c56e2c7. Summary will update on new commits.}

[cubic-dev-ai]

This PR is large and would use a significant portion of your monthly review quota. Comment @cubic-dev-ai review this to confirm that you want cubic to review it.