t27b: which calls lower as the .len field, decided by specs/tri/t27b/lencall.t27 #7524

Port slice of #6198 (under #6063 and #5980).

cli/t27b/src/lower/lencall.rs decides which call t27b lowers as the .len field (W570: t27c's Zig backend prints x.len() and len(x) as the field x.len). That decision is a pure classification over the call's name bytes, its child count, the parser's method mark, and whether a fn named len is declared:

• a method call len with exactly one child: the receiver is that child;
• a no-argument call whose name is a dotted path ending in .len (a.b.len()), every segment non-empty ASCII letters/digits/_, the first not starting with a digit: the receiver is the path;
• a free len(x) with one argument when no fn len is declared or poisoned: the receiver is x.

This moves that decision into specs/tri/t27b/lencall.t27 (tests take their values from the current Rust), mounts its t27c gen-rust output gen/rust/tri/t27b/lencall.rs, and leaves only the node building in the hand-written file.

Known gen-rust limit hit on the way: a slice parameter lowers to an owned Vec<u8> (a []const u8 one to &'static str, #7449), so the glue passes c.name.as_bytes().to_vec().

Done when: the t27b lab corpus of the head matches the master base (pass, blocked and mismatch counts identical, mismatch 0), cargo test -p t27b passes, and t27c test-report specs/tri/t27b/lencall.t27 shows 6 of 6 non-vacuous passes.

Boundary

• specs/tri/t27b/lencall.t27
• cli/t27b/src/lower/lencall.rs
• gen/rust/tri/t27b/lencall.rs

User Scenarios

• Given the t27b compiler's lowering logic for .len field calls resides in hand-written Rust, when the classification rules are expressed in specs/tri/t27b/lencall.t27 and t27c gen-rust produces gen/rust/tri/t27b/lencall.rs, then cli/t27b/src/lower/lencall.rs delegates to the generated code and retains only node construction.
• Given a call a.b.len() where each segment is non-empty ASCII letters/digits/underscore and the first segment does not start with a digit, when the spec classifies it as a dotted-path .len call with zero arguments, then the receiver is the full path a.b.
• Given a free call len(x) with one argument and no function named len declared or poisoned in scope, when the spec classifies it as a candidate for .len lowering, then the receiver is x.

Requirements

• FR-001: The spec specs/tri/t27b/lencall.t27 MUST encode the three classification rules for .len lowering: method call len with one child, dotted-path .len call with zero arguments, and free len(x) with one argument when no len function is declared or poisoned.
• FR-002: The t27c gen-rust output gen/rust/tri/t27b/lencall.rs MUST provide the pure classification function that returns the receiver node or None.
• FR-003: The hand-written cli/t27b/src/lower/lencall.rs MUST call the generated classification function and perform only the node building (wrapping the receiver in a field-access node).
• FR-004: The glue code in the hand-written file MUST convert the call name to Vec<u8> via c.name.as_bytes().to_vec() to satisfy the generated function's owned Vec<u8> parameter requirement.

Success Criteria

• t27c test-report specs/tri/t27b/lencall.t27 exits with exit 0 and reports "6 of 6 non-vacuous passes"
• cargo test -p t27b exits with exit 0
• The t27b lab corpus run shows pass, blocked, and mismatch counts identical to master base with mismatch count 0
• gen/rust/tri/t27b/lencall.rs exists and is produced by t27c gen-rust specs/tri/t27b/lencall.t27