ci/spec22-gems: round-7 bisect — sha256 legs, ffi.open, fiddle flag matrix (incident 13)

[ronaldtse]

Incident 13 round 7 — a bisect that cannot die, and three legs that have never been measured

Round 6's run (factory build-windows 32204381083) produced two proofs and one probe bug:

1. The closure walk is byte-perfect against ground truth. The round-6 artifact now carries the pressed payload images (factory #111 5c2a106); extracted on macOS, all 16 imports of libsass.so match llvm-objdump's read of the real import tables exactly, and all three vendored modules are valid coff-x86-64. The walk's answers are the truth.
2. The ffi failure is the OS's own answer — the shim's covered route forces LOAD_WITH_ALTERED_SEARCH_PATH when the caller named no LOAD_LIBRARY_SEARCH_* order, and the two native.rb attempts differ by route: lib/sassc/libsass.so → OS 126 (covered, materialized, real load); ext/libsass.so → error 5 (EACCES synthesis — that file is not in the image; red herring, dead fallback).
3. The round-6 bisect never produced a single PROBE-DIAG dep-load verdict — FFI::DynamicLibrary.load_library went private in ffi 1.17.4 (private_class_method), the first leg died NoMethodError, and the per-leg rescue LoadError couldn't catch it.

This round's probe fixes the bug and measures what has never been measured on the runner:

• sha256 legs — each vendored module hashed through ruby's patched IO and compared to constants extracted from the pressed image on macOS. A mismatch on a vendored DLL (byte-stable copies) is a windows-side backend read bug, full stop. (libsass.so is recompiled per run by gem install; its comparison is informational.)
• ffi DynamicLibrary.open legs (the public API) — bare-name controls (ADVAPI32.dll, api-ms-win-crt-runtime-l1-1-0.dll), each sibling solo, then the top module. The 126 names "a dep"; these name WHICH.
• fiddle raw-loader matrix on the materialized HOST spelling (not a covered path → the shim passes it through byte-identical → these legs measure the OS loader alone): default-order as the negative control (the standard order never searches the DLL's own dir — 126 there is documented behavior, success there rewrites the model), altered (0x8, ffi's route), and search-default+dll-dir (0x1100). Every succeeded handle is FreeLibrary'd at once so no leg poisons the next via the loader's already-loaded table.

Every leg rescues StandardError and prints its exception class — a probe bug can never again kill the bisect. The original LoadError still re-raises; the probe never gates.

Fixture-only change (ci/spec22-gems/fixtures/probe.rb), ruby -c clean. The factory dogfood is the acceptance: proof-sassc.log must carry a full PROBE-DIAG verdict sheet.