feat(verify): scaffold typed-wasm-verify Rust crate (C1)

Cargo.toml

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+[workspace]
+resolver = "2"
+members = [
+    "crates/typed-wasm-verify",
+]

crates/typed-wasm-verify/Cargo.toml

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+[package]
+name = "typed-wasm-verify"
+version = "0.1.0"
+edition = "2021"
+license = "PMPL-1.0-or-later"
+description = "Post-codegen verifier for typed-wasm L7 (aliasing) and L10 (linearity) constraints on emitted wasm modules"
+repository = "https://github.com/hyperpolymath/typed-wasm"
+readme = "README.md"
+
+[dependencies]
+wasmparser = "0.221"
+thiserror = "2"
+
+[dev-dependencies]
+wasm-encoder = "0.221"

crates/typed-wasm-verify/README.md

@@ -0,0 +1,44 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+# typed-wasm-verify
+
+Post-codegen verifier for typed-wasm **L7 (aliasing safety)** and **L10 (linearity)** constraints on emitted wasm modules.
+
+## What it does
+
+Given a wasm module that carries an `affinescript.ownership` custom section, this crate:
+
+1. **Intra-function check** — walks every function body and computes per-path `(min_uses, max_uses)` for each parameter. Linear params must be `(1, 1)` on every path; ExclBorrow params must have `max_uses ≤ 1`.
+2. **Cross-module check** — given a callee's exported ownership interface plus a caller module that imports those functions, verifies that Linear-param imports are invoked exactly once per execution path.
+
+The custom-section binary format:
+
+```
+u32le  count
+for each entry:
+  u32le  func_idx
+  u8     n_params
+  u8[n]  param_kinds  (0=Unrestricted, 1=Linear, 2=SharedBorrow, 3=ExclBorrow)
+  u8     ret_kind
+```
+
+## Spec of record
+
+This crate is a Rust port of `hyperpolymath/affinescript`:
+
+- `lib/tw_verify.ml` — intra-function verifier (~246 LOC OCaml)
+- `lib/tw_interface.ml` — cross-module boundary verifier (~245 LOC OCaml)
+
+The OCaml files remain the spec of record until behavioural parity is established by the cross-compat test suite (workspace task C5).
+
+## Consumers
+
+- `hyperpolymath/ephapax` — calls into this crate as a Cargo dependency to verify its compile-eph output.
+- `hyperpolymath/affinescript` — invokes the built binary as a subprocess, eventually replacing its OCaml verifier.
+
+## Status
+
+- [x] C1 — Scaffold (types, error enums, public entry stubs)
+- [ ] C2 — Custom-section parser
+- [ ] C3 — Per-path use-range analysis (L7+L10 intra-function)
+- [ ] C4 — Cross-module boundary verifier
+- [ ] C5 — Cross-compat test against affinescript-emitted wasm