t27c --backend ml: lower the arena and file I/O contracts (plan, waits for owner-approved-foreign) #10085

Part of #10024. Follows #10077.

Status: BLOCKED, no Rust will be written. Owner ruling 2026-10-18: everything is .t27 only. What can be expressed in .t27 is done in #10088 (arena, byte-array file model, checkpoint, token stream, MSLH header: 12/12 and 10/10 tests on the Railway lab). The one thing .t27 cannot express is a real host file descriptor, and the --backend ml dispatch itself: both need hand-written Rust in bootstrap/src/main.rs / compiler.rs. This issue records that as the measured blocker; it stays open and cells 24 and 25 of own_model.t27 stay gaps until the owner lifts the rule (label owner-approved-foreign).

Goal

Give t27c a --backend ml target (own_model cell 25) that lowers the two contract specs from #10077 to real code: a bump allocator over a fixed backing array, and open/read/write/close over a host file. The specs fix the behaviour; the backend must reproduce it exactly, so a trainer written in .t27 can run with a heap and read and write checkpoints.

Boundary

• bootstrap/src/main.rs
• bootstrap/src/compiler.rs
• specs/ml/arena_heap.t27 (contract, read only here)
• specs/ml/file_io_contract.t27 (contract, read only here)
• specs/igla/own_model.t27 (cells 24 and 25 change only after the success criteria below are measured on the Railway lab)

User Scenarios

• Given specs/ml/arena_heap.t27, When t27c compile specs/ml/arena_heap.t27 --backend ml runs, Then it emits code whose arena_alloc, arena_reset, arena_mark and arena_release return the same offsets, codes and high-water marks as the spec's own tests assert.
• Given specs/ml/file_io_contract.t27, When it is compiled with --backend ml, Then io_open, io_read, io_write, io_close and the ckpt_write / ckpt_read round trip behave as the spec's tests assert, including all-or-nothing writes and truncate-on-write-open.
• Given an unknown backend name, When t27c compile runs, Then it still falls through to Zig exactly as today, and the existing backends emit byte-identical output.

Requirements

• FR-001: backend_extension (main.rs), compile_source (main.rs) and run_compile (main.rs) MUST each gain an "ml" arm, next to the existing "verilog", "c" and "rust" arms.
• FR-002: compiler.rs MUST gain Compiler::compile_ml(source) -> Result<String, String>, shaped like compile_c and compile_rust: lex, parse, then a new MlCodegen with gen_ml and into_string, with no optimizer pass (the same reason compile_rust skips it).
• FR-003: MlCodegen MUST lower arena operations to bump-allocation over a caller-owned []f32, with offsets in f32 slots and every failure a returned code (ARENA_OK=0, ERR_OOM=1, ERR_SIZE=2, ERR_ALIGN=3, ERR_MARK=4, NO_OFFSET=-1); it MUST NOT trap on out-of-memory.
• FR-004: MlCodegen MUST lower the file I/O contract to host file calls while keeping the contract's semantics: 4 slots of 256 bytes, all-or-nothing writes, write-open truncates, and the "T27C" checkpoint (16-byte header, f32 bit patterns, 4-byte byte-sum checksum).
• FR-005: @bitCast between f32 and u32 already works in the Zig backend and MUST keep working in --backend ml; it is what the checkpoint format relies on.
• FR-006: The existing zig, verilog, c and rust outputs MUST stay byte-identical for every spec under specs/ (the seals under .trinity/seals/ are the check).

Success Criteria

• t27c compile specs/ml/arena_heap.t27 --backend ml and the same for specs/ml/file_io_contract.t27 exit 0 on the Railway lab, and the emitted code passes the equivalent of every test in those specs (10 of 10 each, 0 vacuous).
• t27c suite --repo-root . on the Railway lab shows no seal drift for any existing spec (FR-006).
• specs/igla/own_model.t27 cells 24 and 25 move off 0% only with a PCT whose SOURCES line names the measured result above; all its tests still pass with 0 vacuous.
• No file outside bootstrap/src/main.rs and bootstrap/src/compiler.rs changes in the Rust diff, except new .t27 specs and regenerated seals.