docs(proposals): 0002 access-site carrier section for L2 enforcement (Refs #78) (#86)

## Summary

Drafts proposal 0002 — the `typedwasm.access-sites` custom section that
unblocks `verify_region_binding` (the L2 enforcement pass deliberately
omitted from PR #77).

Per the owner-resolved option A in proposal 0001 §"Open questions" ¶5
(issue #78), the section carries per-instruction mappings `(func_idx,
instruction_byte_offset) → (region_id, field_id)`.

## Wire format decision (Encoding B)

From issue #78's prototype measurement table:

| Encoding | Bytes/access | Per-access overhead | Module overhead |
Status |
|---|---:|---|---|---|
| A flat 4×u32le | 16.0 | +357% | ~2.9% | rejected |
| **B LEB128 per field** | **5.0** | **+43%** | **~1.1%** | **ADOPTED
(v1)** |
| C batched + delta | 3.5 | ~0% | ~1.2% | deferred to v2 |

B sits in the same module-overhead ballpark as C at trivial codec
complexity. C's ~0.1-point reduction does not justify v1 codec surface
area; reserve for v2 once real-world density data justifies it.

## What's specified

- **Wire format**: `u16le version` + LEB128 entries (func_idx,
byte_offset, region_id, field_id)
- **Producer obligations**: emit AFTER all post-codegen rewrites
(wasm-opt, snip, gc); emit alongside `typedwasm.regions`; stable region
indices; all-or-nothing emission
- **Verifier obligations**: `verify_region_binding` pass (closes the PR
#77 omission); 5 new `OwnershipError` variants; gated behind
`unstable-l2-access-sites` cargo feature
- **Versioning policy**: same lenient/additive contract as
`typedwasm.ownership` and `typedwasm.regions`
- **Cross-repo review**: `affinescript` + `ephapax` codegen paths (per
the proposal-0001 review pattern)

## Test plan

- [x] Wire format reviewed against issue #78 prototype measurement
(Encoding B is the v1 ship)
- [ ] Maintainer review of producer + consumer obligations
- [ ] Cross-repo review by affinescript + ephapax maintainers (the only
current `typedwasm.ownership` producers)
- [ ] Promote to `[review]` after first round of feedback
- [ ] Promote to `[accepted]` after cross-repo signoff; then implement
codec + verify_region_binding behind `unstable-l2-access-sites`

## Related

- Issue #78 — access-site carrier resolution; second comment carries the
prototype measurement table
- Proposal 0001 (PR #76, merged) — the schema carrier this proposal
binds against
- PR #77 — pre-stage codec; deliberately omits `verify_region_binding`
pending this proposal

Closes the proposal-0001 §"Open questions" ¶5 deferred work.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath