[bug] t27o: a caller of an out-buffer String fn is converted to a call without the buffer #11111

Goal

A call of a fn that t27o converted into the out-buffer String form must not be converted into a call without the buffer. Either the caller is refused with a reason that names the form (as the Vec form does with R_VECCALL since #11109), or the call passes a buffer.

Why

Found by lane A4 while writing the Vec out-buffer form (#11073): a converted caller of an out-buffer String fn comes out as tag(n).len, a call with the out parameter missing. t27c rejects such a spec at best; at worst a same-arity call reads another meaning. The No-invalid-output rule of #10976 says t27o emits valid output or refuses.

Boundary

• specs/tools/t27o/rust_convert.t27
• gen/rust/tools/t27o/rust_convert.rs
• .trinity/seals/t27o_T27oRust.json

User Scenarios

• Given a Rust fn tag(n: u32) -> String that converts to the out-buffer form, when another fn calls tag(n).len(), then the caller is refused with a reason that names the out-buffer form.
• Given a fn that is not in the out-buffer form, when it is called, then its callers convert as before.

Requirements

• FR-001: A caller of an out-buffer String fn MUST be refused, or MUST pass a buffer; it MUST NOT lose the argument.
• FR-002: The rule MUST live in rust_convert.t27 with a failing test first and a negative control; hand Rust MUST NOT grow (own-language net <= 0).

Success Criteria

• t27b test specs/tools/t27o/rust_convert.t27 ends with exit 0 and 0 tests failing, and t27c test-report reports 0 vacuous passes.
• On the five roadmap repositories no converted spec contains a call of an out-buffer String fn without its buffer, counted with tri t27o-sweep.