feat(#386): safety-profile gate + accurate shared-rebase messaging

[avrabe]

Closes items 1–2 of #386 and adds the safety profile decided there.

1. --profile safety (SR-68) — the new feature

ADR-7 decided meld has a dual identity (generic RFC-46 fuser and sealed-safety
product, both first-class) and specified two attested profiles. Nobody had built
the signal, so ADR-4 ("explicit, not auto") could only warn.

Why a profile and not "strict when attested": attestation defaults true and
--memory defaults auto — so "attested + Auto" is the default invocation.
Erroring there would fail plain meld fuse a.wasm b.wasm for everyone and break the
ecosystem identity ADR-7 declared first-class.

• Profile::{Ecosystem (default), Safety}, FuserConfig::profile, CLI --profile.
• Under safety, the memory strategy must be stated — --memory auto is refused.
  It selects the inter-component isolation model, which decides whether a fault in one
  component can reach another's state.
• Checked before fusion — a profile violation is a build-config error, so it must
  not depend on input shape or leave a partial artifact.
• Ecosystem behavior unchanged. Nothing breaks.

The profile gates, it never transforms: a build passing under safety emits
byte-identical output to the same explicit invocation under ecosystem (pinned by a
test, with reproducible: true so it compares fusion output, not the attestation
nonce).

Scope held deliberately to ADR-4. ADR-7's other binding requirements (per-boundary
strategy declared/attested; silent-downgrade = hard error) are documented as intended
future consumers of this seam, not silently half-done.

2. Accurate shared+rebase messaging (the original #386 fix)

--memory shared --address-rebase warned "UNSOUND" unconditionally — including for
--emit-relocs inputs, where it isn't, and which is the path --pack-rebase/
--share-stack are built on and that the falcon supplier validated on real components
(#370). It also duplicated a better-targeted per-module warning in
address_strategy.rs, while the genuinely dangerous case is already a hard error
(path-F). Now gated on any_component_lacks_reloc_metadata().

Proven RED→GREEN by revert — pre-fix the test fails, capturing the spurious warning
verbatim.

3. Docs that contradicted the code

MemoryStrategy::Auto's public rustdoc said "Both hold → SharedMemory" — but Auto
never picks shared. Fixed there, in the module docs, and in the internal rationale;
dropped a dangling reference to a function that doesn't exist.

4. Discoverability hint (#386 item 3, resolved as "no auto-escalation")

Auto-escalating to shared when inputs "look" reloc-covered is ruled out permanently:
has_reloc_metadata proves presence, not coverage (undecidable, #339); it would
auto-escalate risk and change artifact layout; and every MCU user is already explicit
(--pack-rebase/--share-stack/--address-rebase all require --memory shared).
Instead Auto now reports what's available and lets the caller choose.

Verification

Workspace clippy --workspace --all-targets -D warnings clean, fmt clean, tests
855/0. rivet PASS (SR-68 + SWV-80). meld docs profiles. Live CLI verified
both directions of the gate.

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}