tri t27o-sweep --near N: rank the files one step short of converting whole, with the refusals tagged test or logic #11258

Goal

Add tri t27o-sweep --near <N>: after the table it lists the files that are at most N refused fns away from converting whole, each with its refused fns, the reason of each, and a tag that says whether the refused fn is a test body or logic, so that the next golden port is chosen in one command.

Why

The two golden ports so far (#11157 bitmask.rs, #11255 csr_map.rs) were each found by an ad-hoc ranking script run by hand on the sweep output: files sorted by converted share, then tri t27o <file> read for the refusals. That script is hand-written non-t27 logic and is lost with the scratch directory; each tick repeats the work. Measured on master b6f775178: the sweep of this tree finds 0 of 385 files that convert whole, 92 files with at least one converted fn, and candidates one step short exist (bootstrap/src/host/histogram.rs 22 of 30 fns, bootstrap/src/host/ratelimit.rs 13 of 25, cli/tri/src/night.rs 3 of 6); in csr_map.rs the 3 refusals were all test bodies (windows, is_power_of_two), which is the cheap kind to fix. The rule belongs in specs/tools/t27o/ledger.t27 with the other sweep rules, not in a script.

Boundary

• specs/tools/t27o/ledger.t27
• cli/tri/src/main.rs
• gen/rust/tools/t27o/ledger.rs

User Scenarios

• Given a checkout, when tri t27o-sweep --near 3 runs, then it prints each file with at most 3 refused fns, sorted by refused count and then by line count, with each refused fn's line and reason.
• Given a refused fn inside a #[cfg(test)] module or marked #[test], when it is listed, then it carries the tag test; any other refused fn carries the tag logic.
• Given a file that already converts whole, when --near runs, then it is not listed (it is a port, not a near miss).

Requirements

• FR-001: The ranking and the test/logic tag MUST be rules in ledger.t27, with test blocks, and cli/tri/src/main.rs MUST only pass the flag and print the lines the rule returns.
• FR-002: The output MUST be deterministic and reuse the sweep cache: a second run on an unchanged tree reads every row from the cache.
• FR-003: Hand Rust MUST NOT grow (own-language net <= 0); the generated gen/rust/tools/t27o/ledger.rs MUST be regenerated, never hand-edited, and ledger.t27 MUST be re-sealed with tools/check_seal_currency.py and tools/check_seal_coverage.py ending exit 0.

Success Criteria

• tri t27o-sweep --near 3 on this tree lists bootstrap/src/host/histogram.rs or a file with fewer refusals, in under 5 seconds on a warm cache, and ends with exit 0.
• The new test blocks in ledger.t27 pass (at least 4: ranking order, test tag, logic tag, whole file excluded) and the own-language check reports a net of 0 or below.