feat(p3_stream): static stream cycle detection at fusion time (#142 iii)

[avrabe]

Summary

Closes part of #142 (sub-issue of #94) — implements check (iii) only: SCC ≥ 3 cycle detection in the directed producer→consumer graph from detected StreamPairs. The legal bidirectional-pipe pattern (size-2 SCCs from two independent streams in opposite directions) is explicitly excluded.

Earlier scope (i) dropped after Mythos finding

An earlier commit on this branch also implemented check (i) (type-compatibility) via a role-list heuristic. The Mythos delta-pass auto-scan on the PR correctly identified it as a false-positive path:

validate_stream_pair_graph uses fusion_connections, which returns every component pair sharing any resolved import (sync or stream); when two components are connected via a sync call but each has unrelated stream roles with mismatched element types, the role-list pass raises a false-positive TypeMismatch …

Acknowledged and fixed in commit 3fecb84: the heuristic was dropped. A precise per-import-edge check needs resolved_imports type lookups (walk import descriptors, find stream<T>-typed imports, compare to matched export). LS-R-11 stays status: open tracking that follow-up; the StreamValidationIssue enum + resolver wiring are left in place so the precise variant can plug in later without a public-signature break.

What this PR actually ships

• Cycle detection via Tarjan SCC over StreamPairs' producer→consumer edges
• Error variant Error::StreamValidation(String) that batches every issue from a single fusion attempt
• Pure validate_from_pairs so tests don't need ParsedComponent fixtures
• One approved LS-N entry (LS-R-12) with full causal-factor + process-model-flaw analysis
• One open LS-N entry (LS-R-11) tracking the precise (i) check, with a notes: block explaining the withdrawal and what shape the follow-up needs

Tests (4 new)

• ls_r_12_stream_three_component_cycle_flagged — 3-component A→B→C→A loop
• four_component_cycle_flagged — A→B→C→D→A (size-4 SCC)
• bidirectional_pipe_is_not_flagged_as_cycle — negative: legal A↔B pipe stays clean
• linear_pipeline_is_not_flagged — negative: acyclic A→B→C pipeline stays clean

Full cargo test -p meld-core --lib — 270 tests pass.

Test plan

• All four cycle-detection regression tests green
• Full meld-core lib suite passes
• Mythos delta-pass auto-scan re-runs after rename + scope reduction
• LS-N verification gate finds ls_r_12_*

🤖 Generated with Claude Code

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/p3_stream.rs
meld-core/src/resolver.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[github-actions]

LS-N verification gate

⚠️ 34/35 verified — 1 missing regression tests

	count
Passed (≥1 test, all green)	34
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	1

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-R-13

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[github-actions]

Mythos delta-pass (auto)

✅ NO FINDINGS across 2 Tier-5 file(s)

File	Verdict	Hypothesis
``	✅ NO FINDINGS	—
``	✅ NO FINDINGS	—

_{Auto-run via anthropics/claude-code-action@v1
(SHA-pinned) on the touched Tier-5 files, using the
maintainer's Max-plan OAuth token. See
.github/workflows/mythos-auto.yml and
scripts/mythos/discover.md.}