Stabilize frontend semantics and std boundaries

[LunaStev]

Summary

Fix frontend diagnostics, checked numeric operations, and std/CLI boundary cases across 17 issues. Extract typed HIR, conversions, and async lowering into front/hir; keep exact constant arithmetic in dependency-free utils::const_int.

• Parse negative integer match patterns and report malformed function signatures, imports, and struct fields at the offending token.
• Preserve the left operand's shift type, validate the original shift count, use nonzero bool conversions, and check float-to-integer conversions before lowering. Constant violations produce diagnostics; runtime violations trap.
• Correct environment existence/overflow handling, zero-capacity TCP reads, invalid terminal actions, and invalid CLI option values.
• Add checked borrowed byte subviews, borrowed ByteReader reads, and exact ULEB128/SLEB128 encoded-length helpers.
• Move HIR integration tests with their crate and extend Windows ARM64 and WASM CI regression coverage.
• Declare Darwin amd64 syscall secondary outputs so optimization cannot reuse a clobbered third argument; make the environment fixture portable across checkout line endings and synchronize the UDP receive assertion.

Motivation

Previously, invalid numeric operations could be silently narrowed or reach LLVM with undefined results, malformed declarations could lose the offending location, and several std/CLI boundaries accepted invalid input or reported misleading results. HIR is now a separate consumer of parser semantic facts, without a reverse parser dependency or external numeric libraries.

Closes #739
Closes #730
Closes #731
Closes #732
Closes #423
Closes #424
Closes #509
Closes #513
Closes #648
Closes #649
Closes #746
Closes #747
Closes #748
Closes #749
Closes #759
Closes #761
Closes #762

Target and compatibility impact

• Shifts retain the LHS type. Left shifts discard overflowing bits; signed right shifts extend the sign. Counts must be integers in 0..LHS bit width, checked before narrowing.
• Integer-to-bool means nonzero. Float-to-bool treats only positive/negative zero as false, including true for NaN and infinities. Pointer-to-bool remains unsupported.
• Float-to-integer conversion truncates toward zero and then checks the destination range. NaN, infinities, and out-of-range values produce constant diagnostics or runtime traps. Wide conversions use freestanding lowering without external arithmetic helpers.
• Zero-capacity stream receives return success without EOF or consuming data; datagram receives retain their provider behavior. Invalid terminal actions are rejected before the ioctl on Linux, macOS, and FreeBSD.
• New byte APIs borrow existing storage, preserve outputs/cursor state on failure, and perform no allocation. Source comments describe the borrowing and failure contract.
• Rust consumers now use hir::TypedProgram and hir::async_lower. Compiler/std compatibility revision remains 4. The frontend dependency graph contains only local crates; no libc FFI or numeric crate dependency is added.

Validation

Validation at 7a817450, after HIR extraction and replacement of the numeric dependencies:

• LLVM_SYS_211_PREFIX=/usr/lib64/llvm21 WAVE_RUN_WASM_RUNTIME_TESTS=1 cargo test --locked --workspace --jobs 2: 317 tests passed, including native O0/O2 regressions and wasm32/wasm64 execution and traps. Local socket/PTY tests ran outside the network sandbox.
• Exact integer arithmetic checked against 100 independent Python-integer reference vectors spanning 64–1024 bits, native signed arithmetic, capacity boundaries, and 4,096 sampled IEEE bit patterns.
• LLVM_SYS_211_PREFIX=/usr/lib64/llvm21 cargo clippy --locked --offline --workspace --all-targets --jobs 2 -- -D warnings passed.
• LLVM_SYS_211_PREFIX=/usr/lib64/llvm21 RUSTDOCFLAGS='-D warnings' cargo doc --locked --offline --workspace --no-deps --jobs 2 passed.
• cargo fmt --all -- --check, bash tools/check_std_policy.sh, and git diff --check passed.

Earlier validation before the extraction and numeric utility replacement also passed 291 corpus files, 26 std examples, 60 O0/O2 object builds across the ten selected OS/architecture targets, and feature-isolated WASM execution. Actual non-Linux OS execution remains CI validation.

Validation of the CI fixes in 75f8be1d:

• Windows amd64/ARM64 failures were reproduced locally by feeding a CRLF provider to the environment fixture builder. LF, CRLF, and standalone CR now compile through the same replacement path.
• A local executable model of Darwin's rdx secondary return reproduced the optimized failure before the fix and passed afterward at O0/O2. XNU's syscall return implementation writes that register; the optimized output now reloads it before repeated calls.
• The UDP test now waits for readability before requiring a zero-capacity receive to consume an already queued datagram. It also reports the observed count, EOF, error, and byte on failure. This removes an arrival-timing assumption; actual Darwin execution awaits CI.
• cargo test --locked --test stabilization_17 --jobs 2: 9 tests passed (the opt-in WASM test was not enabled for this focused rerun).
• cargo test --locked --test std_io_regressions --jobs 2 and cargo test --locked --test codegen_regressions darwin_ --jobs 2 passed with LLVM_SYS_211_PREFIX=/usr/lib64/llvm21.
• Eight O0/O2 object builds passed for the updated socket fixture on macOS and Windows amd64/ARM64. Targeted Clippy with -D warnings, fmt, Python compilation, std policy, and whitespace checks passed.

Checklist

• Commits include a DCO Signed-off-by line.
• Tests cover new behavior or the PR explains why no test is needed.
• User-facing changes include documentation or diagnostics updates. Source API comments and targeted frontend/CLI diagnostics accompany the behavior changes.
• The change preserves the license boundary between the compiler and std/.