Phase A (#6655): reuse/rebuild rule and failure fingerprint in specs/verified/reuse.t27 #6670

Goal

Write the one rule of when a sealed artifact may be reused instead of rebuilt, and the deterministic fingerprint of a normalized failure, as a t27 spec. Parent: EPIC #6655 (Phase A items 2, 3, 5, 6; Phase D failure fingerprint and dedup transitions). Feeds #6656.

Where we are

Inventory of origin/master 1c0299f:

• t27c seal records spec_hash and gen_hash_* per backend. It records no toolchain identity and no verdict.
• conformance/trinity/bootstrap_receipt.json records the toolchain identity. The t27b reference cache (fix(t27b-lab): LAB-IMAGE-STALE, 600 s poll, reference cache keyed by use closure + t27c + zig (Closes #6443) #6535) keys on spec bytes + use closure + t27c + zig.
• specs/ci/affected.t27 selects the specs a change touches.
• No failure fingerprint or failure-issue dedup rule exists anywhere in the repo.

Boundary

Allowed: specs/verified/reuse.t27, .trinity/seals/verified_VerifiedReuse.json (written by t27c seal --save).
Out of bounds: compiler, tri code, specs/ci/affected.t27 (reused, not restated), any hash primitive, any service.

User Scenarios & Testing

• Given unchanged spec, closure, toolchain and config and a PASS seal, then the decision is REUSE.
• Given a leaf change, then REBUILD_SPEC. Given a shared import that was rebuilt, then every dependent gets REBUILD_CLOSURE and an unrelated spec stays REUSE.
• Given a toolchain or config change, then the artifact is not reusable.
• Given any identity part that was never recorded, then REBUILD_MISSING (fail closed).
• Given the same normalized failure twice, then the same fingerprint. Given any differing part, then a different fingerprint.
• Given an open issue for a fingerprint, then UPDATE, not a new issue. A failure issue closes only on a passing fix run with a verified seal and no recurrence.
• Given no device evidence, then the hardware state is UNPROVEN.

Requirements

• FR-001: Pure .t27, with tests that run (zig test on the generated Zig).
• FR-002: No hashing. The fingerprint is an injective packing that can be read back.
• FR-003: MISSING never counts as SAME.

Success Criteria

• t27c gen specs/verified/reuse.t27 > r.zig && zig test r.zig prints All 12 tests passed.
• t27c gen-verilog and t27c gen-c on the spec exit 0.
• t27c seal specs/verified/reuse.t27 --verify prints all hashes MATCH.
• Each of these mutants makes zig test fail: MISSING returns REUSE; close without seal_verified; scope truncated to 16 bits; verdict check removed; rebuilt-import check removed.