t27c gen emits code for specs typecheck refuses (35 misread pairs stay 'green')

Refs #6092, Refs #6434

tri misread at master 682564f, from the t27c lab's misread gate: 0 of 35 spec-shape pairs are silent and all 35 are refused by typecheck. But code generation never runs typecheck, so t27c gen* still emits the same wrong output for those specs, and every gate stays green. An outside reader raised exactly this on X: "a compiler that stays green while misreading 41 specs is the scary failure mode evals should hunt" (https://x.com/0xTobiasDev/status/2106491844612018486).

Fix

Every gen-* path runs the same typecheck first. A spec that typecheck refuses produces no output and exits non-zero, naming the refusal. There is no escape flag on the default path.
Each of the 35 refused specs is fixed at the source (28 of the original 41 were a Rust field with no type: pub f: ,), so tri misread reports 0 silent and 0 refused.
A test: a spec with pub f: , makes gen-rust fail with the typecheck message.
Corpus effect, measured on the lab: how many specs gen now refuses, before and after.

🤖 Generated with Claude Code

Boundary

bootstrap/src/compiler.rs

Public context: an outside reader flagged this exact failure mode on X (https://x.com/0xTobiasDev/status/2106491844612018486 -- "a compiler that stays green while misreading 41 specs is the scary failure mode"). Replied from @t27_dev linking this issue. Current numbers on master 682564f: 35 misread pairs, 0 silent, 35 refused by typecheck -- but t27c gen never calls typecheck, so it still emits code for all 35. Second layer (t27b compares with the reference only per file) is #6441.