feat(SR-69): attest per-boundary strategy + the build configuration (ADR-7 P1)

[avrabe]

Delivers ADR-7's "per-boundary strategy declared, attested, observable" — and
fixes a traceability defect found on the way that I think is the more important half.

1. Per-boundary records

One record per fused cross-component call: endpoints, callee function + interface,
the call-lowering class (direct / memory-copy / transcode / async-lift) and
how it was actually wired (inlined-direct / widening-wrapper / thunk).

Captured at the wiring step, not from the lowering seam's inline_eligible: a
widening wrapper takes precedence over inlining, so eligibility alone would
misreport what shipped. A test asserts the inlined-direct records agree with
stats.adapters_inlined, which is exactly what catches that confusion.

Surfaced two ways — embedded in the attestation (auditable from a shipped artifact)
and printed by the new meld fuse --explain:

  c2m0 -> c0m0  gate:math/lib@0.1.0::gate:math/lib@0.1.0#add
      lowering: memory-copy  wiring: thunk            cross-memory

  1 boundaries: 0 direct, 1 memory-copy, 0 transcode, 0 async-lift (0 wired with nothing interposed)

2. The defect this uncovered — shipped artifacts recorded no configuration

SR-28 requires every FuserConfig field to be attested so an auditor can
reconstruct the build. But the parameter-recording code sat behind
#[cfg(feature = "attestation")] — the optional wsc path, which releases do not
build. So shipped artifacts recorded nothing beyond the memory strategy:

• --share-stack — which carries a documented soundness envelope
• --pack-rebase, --address-rebase — which change memory layout
• --profile safety — whose entire purpose is "declared and attested"

The SR-28 sentinel couldn't catch it: it asserted against a map built inline in
the test, never touching real output.

Fixes:

• Typed FusionParameters (not a map — key order fixed by declaration, so
  deterministic under --reproducible by construction; the wsc path's HashMap
  is precisely what makes that path non-reproducible). Label helpers un-gated so
  both paths use them.
• SR-28 completeness is now a compile-time guarantee: attestation_parameters
  destructures FuserConfig exhaustively, so adding a field fails the build until
  it is recorded or explicitly acknowledged (each exclusion documented with why).
  Demonstrated by adding a probe field → error[E0027]: pattern does not mention field, then removing it.
• The SR-28 test now asserts against the real serialized attestation, values
  round-tripping.

Notes

Neither addition perturbs the artifact hash — it is computed over the module with
the attestation and provenance sections stripped (verified recipe in
component_provenance.rs).

Verification

rivet SR-69 + SWV-81 (PASS). fmt 0, clippy --workspace --all-targets -D warnings 0, tests --workspace 858/0 and --all-features 857/0 (both, per
the lesson from #387).

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}