Refactor the crate's internal structures to make invalid states unrepresentable

[marlls1989]

What this is for. Making the crate more maintainable and reducing its technical debt — by
sharpening GUIDELINES.md, the standing rules every contribution is held to, and bringing the code
into compliance with the sharpened version. Six rules are involved: two that shaped the work from the
start, two added after a review found the first pass had drifted from them, and two more added after
an audit of how the crate uses its own logic library. Two behaviours change, both named below.

A classification is a variant

Picking the variant is the classification, and the variant carries exactly the fields that kind has;
a field that only sometimes applies is an Option inside it.

• src/emit/block.rs holds Block: eleven variants over six payload structs, one for each Liberate
  block form, with a single Display writing the whole block and the -type literal owned by the arm
  that emits it. It is owned and hashable, so it is also the dedup key — Blocks is
  IndexMap<Block, Vec<Minterm<Symbol>>>, keyed on the block value. DefineArc, LeakageBlock,
  BlockKind and MaskedArc are gone, and Conflation { block, states } makes the conflation
  report's subject the emitted block itself.
• A hazard's cause carries its own cardinality: Toggle { pin: PinEdge },
  Race { pins: [PinEdge; 2] }, Pulse { pin: PinEdge }. Empty and three-or-more are
  unrepresentable, and the rule that a lone toggle yields no constraint is structural rather than
  prose.
• The analysis returns Result<Derivations, machine::ExplorationLimit>, so the invariant its doc used
  to state — stopped means every derived field is empty — holds because a stopped exploration hands
  back no Derivations to hold fields.
• edge.rs speaks Edge through its decision core instead of an is_rise: bool, so a pair whose two
  halves disagree cannot be built, and EdgeArcs states its read-gate factorisation once.
• state_holding is derived from the cached regions; the CLI's spec source and output destination are
  types rather than a sentinel string and a loose bool-plus-path.

Structure is held until the edge

Display is for output; a function that returns rendered text has already lost.

• A condition is a BoolExpr end to end. logic::product builds one from literals and the logic
  layer's rendering toolkit is deleted, along with Hazard's five *_str methods.
• A -vector, -ic and -pinlist are three projections of one column walk, typed as VectorValue
  and IcColumn in src/emit/tcl.rs, so they cannot fall out of alignment.
• Diagnostics render through borrowing Display adapters in src/report.rs.
• The deck reaches the sink through one writer: cell_arcs returns blocks, main writes them. The
  Liberty library writes through an indenting fmt::Write adapter rather than rendering a string and
  re-parsing it to re-indent, and each artifact renders its own alphabet through its own Display.

The library's types are the ones to use

An audit of every espresso-logic call site, and of the crate's own vocabulary against the library's,
found the same shape rebuilt by hand in a dozen places. GUIDELINES.md gains two sections — one
naming which type owns which job, one stating that the library's operations come verified, so a
hand-rolled equivalent is a second implementation nobody tests and is a defect whether or not it
works. The audit's own lesson is written down with them: most of these were not written in ignorance
of the library but after failing to find one method that did the whole job, when the answer was a
composition of two.

A name-to-Boolean mapping is a Minterm<Symbol>. A variable a minterm does not define is by
definition a don't-care, so a partial mapping needs no separate type and no absent-key convention.
Gone, each replaced by the row it always was: logic::assignment, which took a Minterm and returned
a map of it; confluence::node_levels_at; ExposedLevel; VictimNode; and the by-name adapters that
existed only to restore lookup over vectors of them.

ArcLevels and RestLevels stay, because neither was ever the name-to-Boolean map — their fields
were. ArcLevels groups the three rows one arc samples, and on master held them as
Vec<(Symbol, bool)> and Vec<ExposedLevel>; it now holds outputs, exposed_start and
exposed_end, a Minterm<Symbol> each. A minterm gives one value per variable, so two mappings over
one node set cannot be one row. Constraint.nodes and ConstraintColumns.probed are minterms for the
same reason, and Hazard::node_levels is a method deriving its row from the state the hazard probed
rather than a field storing it again.

A set of tri-state rows over a shared header is a Cover. StateRegions held each of its three
regions twice — once as an espresso Cover, once as Vec<StateCube>, a positional
Vec<Option<bool>> aligned by hand to a separate name vector — with a projection keeping them in
step, and its own comment admitting the two were the same cover. The hand-rolled half is gone, and
with it region_cubes, verilog.rs's level_at (which re-implemented Minterm::value_of as a
linear name scan), and statetable.rs's two index maps and the loop over them that re-implemented
Minterm::project_to.

Operations come from the library. Three hand-written copies of BddBuilder::build_cover's
per-cube fold are gone. A pin's function is Cover::to_expr_by_index, rendered by BoolExpr's own
Display at the sink; both hand-written sum-of-products assemblers went with them, including one
that decided a function was a tautology by string-comparing its rendered text. Comparing two machine
states is a Kleene XOR of the two rows rather than a per-variable loop, and the one-reference-against-
many case in width.rs is that XOR folded with OR. merged_victims is Minterm::or for the variable
set composed with project_to_labels for the levels.

One datum, one representation. A state-table column is held once under both its names
(StateNode { signal, node }) rather than as a vector and a map that a test helper had to invert,
relying on an injectivity nothing enforced. A hazard derives its victim levels from the state it
probed instead of storing them again, and the one-probed-state invariant is stated where the
remaining views are declared and asserted where they are copied.

Ordered containers that bought nothing are unordered. The exploration's candidate pool is a
HashSet — its order was never read and it reaches four million entries on the candidate path — and a
warning's outcomes are filed in a HashMap. Which observation supplies a general block is now
schedule-dependent, recorded in KNOWN-ISSUES.md beside the free choice it belongs to.

Errors

The crate has one error style, taken from espresso-logic: hand-written Display and
std::error::Error with a real source() chain, From for composition, From<_> for io::Error at the
boundary, #[non_exhaustive], and small leaf errors wrapped by composites that add the context they
have. thiserror is dropped from the dependency list and Box<dyn Error> from run, which returns
io::Result<()>. ExplorationLimit is a leaf naming which budget stopped an exploration and at what
ceiling; ModelError::Exploration wraps it and names the cell, the way its seventeen siblings do. The
CLI's io boundaries name the path they were given, so a missing spec or an unwritable directory says
which one.

Two behaviour changes

A run that passes an exploration budget fails at that cell and exits, rather than analysing the rest
and listing every offending cell at the end. ExplorationLimit propagates with ? instead of being
stashed on the cell and scanned later, so AnalysedCell.unexplored and the scan are gone.

A run that fails partway through writing its artifacts leaves none of them: each is written to a
sibling temporary path and renamed into place at the end, so a downstream Liberate run cannot read a
half-written output directory.

What changes in the output

Conditions and functions spell as A & !B where they spelled A*!B — both notations are accepted by
Liberty and Verilog alike, and the hand-rolled joins were the defect. A Liberty function may also
come out factored, A & (B | C) rather than A & B | A & C, since the library's own lowering is now
what produces it; nothing ever required a flat sum of products. Hazards are reported on stderr and
nowhere else: the emitted Tcl and .lib state the timing that removes a hazard and carry no comment
about the hazard itself. Nothing else moves.

A value with more than one component takes a name

A tuple is an ordinary Rust value inside a function — a map's key and value, enumerate, zip, a
buffer a foreign signature dictates — but it may not outlive the scope that makes it, and neither may
a struct or enum variant that tells its components apart by position. GUIDELINES.md states the rule;
the crate is brought into line with it. Named where they were positional: Capture,
Sample/Firing/Move, Delta, DerivedArcs, RegionAction, SignalDef, OutcomeField,
System, FiringIdentity/HiddenFiringIdentity, StateNode, TransitionEvent, SeparationRole,
and Projected's columns. src/emit/block.rs owns the emitted-form vocabulary, so a type naming what
the analysis decided is named for that instead: TransitionEvent is the transition an arc records,
SeparationRole the kind of separation a hazard calls for and which end it constrains.

Tests assert properties

A test states a property of the thing under test and asserts it semantically, and it holds for every
output the tool is free to produce. Running the code twice and asserting the two results agree is not
a test of behaviour: it passes whenever the two paths are self-consistent, including when both are
wrong. That holds whatever the currency — text, values, counts or multisets. A test resting on
equality often asserts no property at all but immutability, which is a fact about the previous run
rather than about the thing under test. The property a test asserts is one the code or its
documentation states; where neither does, the claim belongs there first.

Where a correspondence between the parts of one output is the claim, that correspondence is itself a
property: Liberate reads a block's -pinlist, -vector and -ic as positional columns of one
argument, so those three agreeing on the pin order a run produced is the contract with that reader.
Emitted columns are now read by name off the emitter's own column list, so no minterm's stored header
order reaches the output, and a test states that correspondence without fixing which order a run
picks.

An order kept in the code needs a motivation stated where the order is, and two kinds qualify: a
reader outside the crate that requires the position, or an algorithm made cheaper than its unordered
form — sorting to dedup is a reason by itself. An order bought only for its own stability is not;
"held sorted so the report is stable" answers to nothing. Where determinism is not required the
cheaper variant wins, so a sort whose stability cannot be observed is sort_unstable.

Above all of it, GUIDELINES.md now states that efficiency and correctness come first and that every
rule about how the code is shaped serves those two — code that compromises efficiency to keep an order
is wrong, and a test that checks the output matches a reference is not establishing correctness.

Twenty comparison-shaped tests across arcs_tcl.rs, liberty.rs, statetable.rs, verilog.rs,
model.rs, main.rs and edge.rs now assert properties instead, and the three comparator helpers
arc_shape, shaped_blocks and sorted_blocks are deleted with their last consumers. tests/cli.rs
is dissolved into the modules it tests: no test spawns the cellsmith binary, and none asserts an exit
code.

Dead determinism scaffolding removed

explore's candidate ranking — the settlement and depth quantities, the depth relaxation, the ranked
pool and its sort — is deleted. It ordered the whole pool and pruned nothing, so the seed set is
unchanged and only the order seeds enter the queue, which nothing may depend on. The walk was already
schedule-shaped past the seed segment: each BFS level collects into a HashMap whose iteration order
feeds both ex.order and the next frontier, which explore's own comments call free choices. The
crate's only #[allow] went with a write-only field in edge.rs's forcing scan.

How that is established

The green bar, and nothing else: cargo fmt --all --check,
cargo clippy --all-targets --locked -- -D warnings, cargo build --all-targets --locked,
cargo test --locked, cargo doc. 408 lib and 27 bin tests pass; no #[allow] remains in src/.

Correctness here is the same set of arcs, hazards and constraints, never identical bytes — emission is
not reproducible run to run, and it is not meant to be. Measured on one binary twice over
examples/cells.toml --when: cells_arcs.tcl differs by 6016 lines while cells.v, cells.lib and
cells_cells.tcl are byte-stable. The tests are what catch a regression, at the site where it happens.

Findings declined, and shapes left alone

Two findings from review were declined on their merits. One asked for
*std::slice::from_ref(&node) to be replaced; clippy::cloned_ref_to_slice_refs recommends exactly
that form, so the existing code was already right. The other assumed an intra-doc link would be
dropped; instead TemplateSpec was widened to pub so the link resolves.

Deliberately untouched, each because it is a shape the rule permits: model.rs's signal_regions()
and its call sites, which is std's collectible (K, V) protocol; the product-literal buffers in
emit/arcs_tcl.rs, iterated on the spot; the argument buffers whose shape Minterm::with_labels and
compose_map dictate; and statetable.rs's positional row types, which are a projection made at the
point of writing, since the Liberty statetable and the Verilog UDP are columnar formats.

Record correction. Commit 5017397's message names a type ReportField; the type delivered is
SubblockField in src/main.rs. The message is not rewritten.

Deferred, and recorded in KNOWN-ISSUES.md. Seed settling still runs sequentially, a shape that
only survived as the ordering's justification; parallelising it is a critical-path change and its own
pass. And the (discovered, ordinal) key that picks among equally dominant observations stays, with
the sites a removal would have to answer for written down.

Benchmarks

The thread count a target is measured at is asked for at the point of running it:
CELLSMITH_BENCH_THREADS names the widths as a comma-separated list, max standing for the width the
global pool was built with, and unset measures once with nothing pinned. A width is a point on one axis
rather than a mode, so the single-threaded measurement is the n=1 point of a sweep. Every target
reads the same list.