feat(compiler): close borrow ownership boundary

[sanohiro]

Summary

• close the C-B borrow/ownership wave through L2e across parser, checked HIR, MIR, interfaces, LLVM lowering, and whole/per-unit compilation
• preserve exact return provenance for direct, captured, imported, and function-value calls, including path-selected cleanup bits for recursively Move returns
• add shared and exclusive parameter modes with caller-owned storage, alias/invalidation checks, replacement cleanup, and ABI parity
• keep this as one producer-to-consumer capability boundary because splitting provenance, cleanup, or borrow consumers would leave an unsound dormant ABI seam and duplicate the same cross-layer proof

Validation

• focused owner: local named function-value Move-return cleanup
• focused owner: returned-borrow LLVM capture contracts for definitions, imports, and thunk offsets
• focused owner: borrowed_params (10 tests)
• scripts/test-pr.sh
• scripts/cargo.sh clippy --workspace --lib --bins --locked -- -D warnings
• final-SHA scripts/pre-pr.sh --findings-fixed attestation

Review

The bounded review found two P1 root classes, both fixed in 78c9ad65:

• fresh local function types now retain the computed Move-return cleanup ABI, with a local named-function regression
• returned shared-borrow roots no longer claim LLVM captures(none); non-returning shared borrows retain the optimization contract

The fix audited and updated every sibling declaration/thunk application site and added direct/imported/offset owner coverage.