feat(verify): scaffold typed-wasm-verify Rust crate (C1)

Adds a new Cargo workspace at the repo root with one member:
`crates/typed-wasm-verify`. The crate is the Rust home for typed-wasm's
post-codegen L7 (aliasing) + L10 (linearity) verifier. This commit lands
the scaffolding only — public types, error enums, and stubbed entry
points. Real implementations come in follow-ups C2/C3/C4.

Why a Rust crate here?
----------------------

- The ReScript parser/checker in `src/parser/*.res` is on the way out
  (ReScript ban across hyperpolymath repos), so the canonical
  surface-level checker will be Rust. Starting with the post-codegen
  verifier — a self-contained piece that operates on emitted wasm
  rather than on `.twasm` source — lets the port begin without first
  needing a `.twasm` parser.
- Downstream consumers want a Rust dependency: ephapax (already Rust)
  to call into directly via a Cargo path/git dep, and affinescript
  (OCaml) to invoke as a subprocess until full FFI lands.

Spec of record
--------------

Both modules are direct ports of:

  - hyperpolymath/affinescript:lib/tw_verify.ml    (~246 LOC OCaml)
  - hyperpolymath/affinescript:lib/tw_interface.ml (~245 LOC OCaml)

Until the cross-compat suite (C5) is green, those OCaml files remain
authoritative.

Public surface (this commit)
----------------------------

- `OwnershipKind` — 4-variant enum with `from_byte` decoder matching the
  OCaml fallback semantics (anything outside 0..=3 → Unrestricted).
- `OwnershipError` — 4 variants for intra-function violations
  (LinearNotUsed / LinearDroppedOnSomePath / LinearUsedMultiple /
  ExclBorrowAliased), each carrying `func_idx` + `param_idx` and a
  `thiserror`-derived Display matching the OCaml `pp_error` output.
- `CrossError` — 2 variants for cross-module boundary violations
  (LinearImportCalledMultiple / LinearImportDroppedOnSomePath) carrying
  `caller_func_idx`, `import_func_idx`, `import_name`.
- `FuncInterface` — exported-function signature carrying its ownership
  kinds, mirroring `Tw_interface.func_interface`.
- `VerifyError` — top-level error type covering wasmparser failures plus
  the two violation vectors.
- `OWNERSHIP_SECTION_NAME` — the `affinescript.ownership` custom-section
  name constant.
- Three stubbed entry points (`verify_from_module`, `extract_exports`,
  `verify_cross_module`) — all `todo!()` until C2/C3/C4 land. Signatures
  are pinned now so consumers can already start writing call sites.

Dependencies
------------

  - wasmparser 0.221 — for module/instruction walking in C3/C4
  - thiserror 2     — error-enum derive
  - wasm-encoder 0.221 (dev) — for synthesising test fixtures in C2/C3

Build status
------------

  $ cargo build -p typed-wasm-verify
    Finished `dev` profile [unoptimized + debuginfo] target(s)
  $ cargo test  -p typed-wasm-verify
  running 1 test
  test tests::ownership_kind_byte_roundtrip ... ok
  test result: ok. 1 passed; 0 failed; 0 ignored

Follow-up tasks
---------------

  C2 (#37) — wire the `affinescript.ownership` custom-section parser
             (u32le count + per-entry header)
  C3 (#38) — port `tw_verify.count_uses_range` over wasmparser ops and
             implement the per-fn / per-module verifier proper
  C4 (#39) — port `tw_interface.{extract_exports, verify_cross_module}`
  C5 (#40) — cross-compat test against affinescript-emitted modules
  C6 (#41) — ephapax-wasm emits the custom section
  C7 (#42) — ephapax-cli gets `--verify-ownership`

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+[workspace]
+resolver = "2"
+members = [
+    "crates/typed-wasm-verify",
+]

Cargo.toml

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+[package]
+name = "typed-wasm-verify"
+version = "0.1.0"
+edition = "2021"
+license = "PMPL-1.0-or-later"
+description = "Post-codegen verifier for typed-wasm L7 (aliasing) and L10 (linearity) constraints on emitted wasm modules"
+repository = "https://github.com/hyperpolymath/typed-wasm"
+readme = "README.md"
+
+[dependencies]
+wasmparser = "0.221"
+thiserror = "2"
+
+[dev-dependencies]
+wasm-encoder = "0.221"

crates/typed-wasm-verify/Cargo.toml

@@ -0,0 +1,44 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+# typed-wasm-verify
+
+Post-codegen verifier for typed-wasm **L7 (aliasing safety)** and **L10 (linearity)** constraints on emitted wasm modules.
+
+## What it does
+
+Given a wasm module that carries an `affinescript.ownership` custom section, this crate:
+
+1. **Intra-function check** — walks every function body and computes per-path `(min_uses, max_uses)` for each parameter. Linear params must be `(1, 1)` on every path; ExclBorrow params must have `max_uses ≤ 1`.
+2. **Cross-module check** — given a callee's exported ownership interface plus a caller module that imports those functions, verifies that Linear-param imports are invoked exactly once per execution path.
+
+The custom-section binary format:
+
+```
+u32le  count
+for each entry:
+  u32le  func_idx
+  u8     n_params
+  u8[n]  param_kinds  (0=Unrestricted, 1=Linear, 2=SharedBorrow, 3=ExclBorrow)
+  u8     ret_kind
+```
+
+## Spec of record
+
+This crate is a Rust port of `hyperpolymath/affinescript`:
+
+- `lib/tw_verify.ml` — intra-function verifier (~246 LOC OCaml)
+- `lib/tw_interface.ml` — cross-module boundary verifier (~245 LOC OCaml)
+
+The OCaml files remain the spec of record until behavioural parity is established by the cross-compat test suite (workspace task C5).
+
+## Consumers
+
+- `hyperpolymath/ephapax` — calls into this crate as a Cargo dependency to verify its compile-eph output.
+- `hyperpolymath/affinescript` — invokes the built binary as a subprocess, eventually replacing its OCaml verifier.
+
+## Status
+
+- [x] C1 — Scaffold (types, error enums, public entry stubs)
+- [ ] C2 — Custom-section parser
+- [ ] C3 — Per-path use-range analysis (L7+L10 intra-function)
+- [ ] C4 — Cross-module boundary verifier
+- [ ] C5 — Cross-compat test against affinescript-emitted wasm