t27b: move the node scans of lower.rs (calls_in, decls_of, ref_mutable_names, misprinted_ifs, mark_tail_returns and more) to specs/tri/t27b/ast_scan.t27 #8347

Port slice of #6198 (t27b written in t27), under #6063 and #5980. It follows #8249, whose specs/tri/t27b/ast_walk.t27 byte form of a node list it reuses.

What

cli/t27b/src/lower.rs collects nodes from a list of t27c AST nodes with hand-written Rust recursions over compiler::Node:

• names_in;
• array_locals, t27c's collect_array_locals;
• decls_of;
• calls_in;
• scan_addr_taken;
• count_assigns;
• ref_mutable_names, the reference's collect_mutable_names with its walk into if / while / for bodies only;
• misprinted_ifs, with its struct-literal rule;
• mark_tail_returns, gen-zig: brace invariants and tail expressions become 'value ignored' (16 specs do not compile) #6315's zig_tail_returns.

This issue moves them to specs/tri/t27b/ast_scan.t27. Each scan reads flat's bytes and writes a mark per node it collects. A small marked in lower.rs returns the marked nodes in preorder, so each collector keeps its signature and fills its set, map or list from them in one line.

Plan

• The spec has test blocks on hand-built trees. Their expected values come from the hand-written Rust on master.
• t27c gen-rust writes gen/rust/tri/t27b/ast_scan.rs, which is mounted in lower.rs as ax.
• Evidence: seal, t27c test-report with 0 vacuous, and tri mutate spec. A differential on random trees checks the deleted collectors against the new ones, including the preorder of calls_in and decls_of and the node addresses misprinted_ifs and mark_tail_returns collect. Then cargo test -p t27b, and signed corpus receipts of base and head (verified: a lane verdict over two corpus receipts, and lab receipts for a requested commit (Closes #7672) #7686).

Done when

• lower.rs loses those hand-written bodies, its hand glue stays within master's check_budget caps, and the net change in hand lines under cli/t27b/ is negative.
• The corpus receipts show no file changed its verdict or its t27b asm digest, apart from the new spec itself.
• The AGENTS.md t27b remainder line is re-measured.