feat(p3_stream): LS-R-11 layer-2 per-edge precise type-mismatch

[avrabe]

Summary

Promotes the v0.13.0 stream-typed-import heuristic to a per-edge precise check for the common path. New `export_stream_elements` walks `comp.component_func_defs[export.index]` to resolve a `Func` export to its underlying type:

• `ComponentFuncDef::Import` reuses the importer-side typeref walker
• `ComponentFuncDef::Lift` looks up `CanonicalEntry::Lift`'s `type_index` and walks the function signature directly
• `ComponentFuncDef::InstanceExportAlias` is deferred → falls back to the layer-1 heuristic (LS-R-11 limits block updated)

For each resolved import edge where BOTH endpoints resolve to non-empty stream-element lists, multisets are compared directly; mismatches emit `TypeMismatch` keyed to the exact `(producer_component=exporter, consumer_component=importer)` pair with the real element types from each side's signature.

Layer-1 still fires for connections not precisely checked; the v0.13.0 heuristic remains the safety net.

Scope change

Originally bundled with a Tier-5 registration of `provenance.rs` in `.github/workflows/mythos-auto.yml`. Split out to a follow-up PR after CI revealed that `anthropics/claude-code-action` requires the workflow file to be byte-identical to main for PR runs (workflow self-reference breaks the AI scan auth flow even though the edit doesn't touch the action's logic). The Tier-5 registration will ship as a tiny separate PR after this merges.

4 new regression tests

• `export_stream_elements_walks_lift_function_signature`
• `export_stream_elements_returns_empty_for_alias_export`
• `ls_r_11_per_edge_lift_export_mismatch_raises`
• `per_edge_matching_lift_export_does_not_raise`

Test plan

• 285 lib + 22 p3_stream tests pass
• `cargo clippy --all-targets -- -D warnings` clean
• Pre-commit hooks pass
• CI green (now expected since workflow self-reference is gone)
• Mythos AI scan on p3_stream.rs succeeds

🤖 Generated with Claude Code

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/p3_stream.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[github-actions]

LS-N verification gate

⚠️ 35/37 verified — 2 missing regression tests

	count
Passed (≥1 test, all green)	35
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	2

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-R-13
• LS-M-6

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[github-actions]

Mythos delta-pass (auto)

✅ NO FINDINGS across 1 Tier-5 file(s)

File	Verdict	Hypothesis
``	✅ NO FINDINGS	—

_{Auto-run via anthropics/claude-code-action@v1
(SHA-pinned) on the touched Tier-5 files, using the
maintainer's Max-plan OAuth token. See
.github/workflows/mythos-auto.yml and
scripts/mythos/discover.md.}