Implement immutable typed reference contracts

[nikstern]

Summary

• implement ADR-0156 typed reference declarations, equality guards, deterministic entity IDs, and cross-bundle/CSDL linting
• enforce immutable references and deterministic identity in one staged actor pre-commit contract across create, update, composite, native, and optimized-runtime paths
• add deterministic hot-reload audits plus bounded L0 SMT, L1 Stateright, composite, property, DST persistence, and HTTP coverage

Validation

• cargo test --workspace -- --test-threads=1
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check
• mandatory code-quality review: PASS
• mandatory DST compliance review: PASS
• live local Turso-backed HTTP server:
  • missing typed-reference target returned 409 ReferenceTargetMissing
  • valid target created a document with canonical derived SHA-256 ID
  • rebinding to another existing target returned 409 ImmutableReferenceViolation

Tradeoffs

The runtime pre-resolves target existence and validates a fully materialized prospective state before any event or side effect is committed. This adds bounded lookup and validation work to contracted writes, but it gives every write origin the same atomic behavior and prevents optimized paths from weakening the contract.

Formal verification uses bounded symbolic identity classes grouped by target entity type. The bound is derived from reference slots, parameter slots, and existing identities, so equality cases remain exhaustive within the finite model while avoiding an unbounded identifier domain.

Tracking

• Task 58
• ADR-0156
• Fork-only scope; upstream issue docs: accept immutable typed reference design nerdsane/temper#411 is intentionally unchanged.