test(stdlib): AOT smoke gate (#136) + multi-module integration (#137)

[hyperpolymath]

Final STAGE-A closers — both run under dune runtest (CI).

• ci: add stdlib-wide AOT compile-smoke gate #136: test_stdlib_aot.ml drives every stdlib/*.affine through resolve→typecheck→borrow→Deno-ESM codegen (one Alcotest case/file). 19/19. AOT path can't silently rot.
• test: multi-module integration test using several stdlib modules together #137: one program that uses prelude+string+option+collections together and exercises a symbol from each — proves cross-module resolution/typecheck/codegen as a coherent set, not file-by-file.

Surfaced + fixed two real coherence gaps at source:

1. resolve_and_typecheck_module type-checked imported modules with a raw check_decl fold (no forward-declaration) → a module with internal forward refs (binary_search→binary_search_helper) broke only on the import path. Now uses Typecheck.check_program (forward-pass) threading the module's own resolved imports as ~import_types — imported modules check identically to standalone.
2. option/collections exposed zero pub API (ADR-011 requires pub for cross-module). Marked the exercised API (unwrap_or, reverse) public.

• suite 233 → 253, all green; stdlib 19/19 standalone unchanged

Refs #128
Refs #136
Refs #137

[github-actions]

🔍 Hypatia Security Scan

Findings: 44 issues detected

Severity	Count
🔴 Critical	12
🟠 High	21
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/compile.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/runner.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence