feat(361): support same-memory string transcoding (lift the #360 hard-fail)

[avrabe]

Closes #361 — supports same-memory string transcoding, lifting the #360
hard-fail.

Background

#360 hard-failed a sync boundary that needs transcoding but does not cross
memory (e.g. --memory shared fusion of a UTF-8 caller + UTF-16 callee) — the
loud-not-silent placeholder for the gap the call-lowering seam surfaced. This
lands the actual capability.

The fix is small — the adapter already supported it

generate_transcoding_adapter is memory-index-parameterised: source reads
use caller_memory, destination writes use callee_memory, and it transcodes
byte-by-byte (there is no cross-memory memory.copy). So when the two are
the same memory (both 0 under --memory shared), it transcodes correctly
within that one memory. Only the class dispatch was gating it — it reached
Transcode only when memory was crossed.

• call_lowering.rs — resolve_call_lowering_plan now routes any
  needs_transcoding boundary to Transcode regardless of crosses_memory, and
  the refactor(adr7): extract the per-boundary call-lowering seam (path-H inc 2) #360 hard-fail is dropped. (same_memory_transcoding_hard_fails unit test →
  ..._routes_to_transcode.)

Verification

• test_361_same_memory_utf8_to_utf16_transcoding — the SR-17 UTF-8→UTF-16
  'Hello' fusion under SharedMemory, executed on wasmtime, returns 500
  (correct transcode within the shared memory), not a verbatim mis-copy.
  Confirmed it hard-failed before this change (baseline).
• 8 call_lowering truth-table unit tests updated + green.
• Full meld-core suite green (0 failures); fmt + clippy clean.
• SR-17 (correct string transcoding) gains the same-memory execution oracle.

Coverage note

The execution oracle covers UTF-8→UTF-16. The other same-memory directions
(UTF-16→UTF-8, latin1+utf16) route through the same memory-index-parameterised
adapter, but are not separately execution-tested here — a follow-up could add
them, mirroring the cross-memory SR-17 direction matrix.

Tier-5 (adapter/) → Mythos delta-pass below.

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/adapter/call_lowering.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[avrabe]

Mythos discover pass (#361 same-memory transcoding) — NO FINDINGS

Self-conducted (backed by the execution oracle) + CI auto-Mythos as the independent second check. The change is small: resolve_call_lowering_plan routes needs_transcoding → Transcode regardless of crosses_memory, dropping the #360 hard-fail.

Hypotheses examined:

1. Does routing same-memory transcoding to Transcode produce correct output? YES — test_361_same_memory_utf8_to_utf16_transcoding fuses under SharedMemory, executes on wasmtime, and returns 500 (correct UTF-8→UTF-16 transcode). The adapter is memory-index-parameterised (src caller_memory / dst callee_memory, both 0), byte-by-byte transcode, no cross-memory memory.copy, so same-memory is a valid special case.
2. Regression on other classes? No — crosses_memory && !needs_transcoding still → MemoryCopy; !crosses_memory && !needs_transcoding still → Direct. Only the previously-hard-failed !crosses_memory && needs_transcoding cell changed (fail → Transcode). Full suite green.
3. Inline eligibility? Transcode is never inline_eligible (only Direct is) — unchanged.

Coverage note (honest): the execution oracle covers UTF-8→UTF-16 only; the other same-memory directions (UTF-16→UTF-8, latin1+utf16) route through the same parameterised adapter but are not separately execution-tested. Not a correctness risk introduced here (same adapter as the verified cross-memory SR-17 matrix), but a follow-up could add the same-memory direction matrix.

[github-actions]

Mythos delta-pass (auto)

✅ NO FINDINGS across 1 Tier-5 file(s)

File	Verdict	Hypothesis
meld-core/src/adapter/call_lowering.rs	✅ NO FINDINGS	—

_{Auto-run via anthropics/claude-code-action@v1
(SHA-pinned) on the touched Tier-5 files, using the
maintainer's Max-plan OAuth token. See
.github/workflows/mythos-auto.yml and
scripts/mythos/discover.md.}

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}