Phase A (#6655): invalidation frontier over the use graph in specs/verified/frontier.t27 #6673

Goal

Walk a dependency graph once and decide REUSE or the reason to rebuild for every node, using the per-node rule of specs/verified/reuse.t27 (#6670). Parent EPIC #6655, Phase A: "deterministic dependency closure and invalidation semantics" plus the tests for unchanged, leaf, shared-dependency and toolchain changes.

Where we are

specs/verified/reuse.t27 (PR #6671) decides one node. specs/ci/affected.t27 and t27c deps-tree know the use edges. Nothing turns those into a per-node reuse/rebuild frontier.

Boundary

Allowed: specs/verified/frontier.t27, .trinity/seals/verified_VerifiedFrontier.json (written by t27c seal --save).
Out of bounds: specs/verified/reuse.t27 (used, not changed), the compiler, tri, CI.

User Scenarios & Testing

• Given nothing changed, then every node is reused.
• Given a leaf change, then only the leaf is rebuilt.
• Given a shared base change in a diamond, then the whole cone is rebuilt and the bystander is reused.
• Given a change on one side of the diamond, then the top is rebuilt and the other side is reused.
• Given a toolchain change, then every node is rebuilt.
• Given an import whose sealed verdict failed, then its importers are rebuilt.
• Given a forward, self or out-of-range edge, then the importer is REBUILD_MISSING (fail closed).
• Given the same input twice, then the same frontier.

Requirements

• FR-001: Pure .t27, one linear pass over nodes in topological order.
• FR-002: An uncheckable edge never yields REUSE.

Success Criteria

• t27c gen specs/verified/frontier.t27 > f.zig && zig test f.zig prints All 9 tests passed.
• t27c gen-verilog and t27c gen-c exit 0. t27c seal specs/verified/frontier.t27 --verify prints all hashes MATCH.
• Each mutant makes zig test fail: forward-edge check dropped; forward check off by one (j > i); rebuilt flag never set; edge direction reversed; reused count doubled.