fix(never-raise): derive the family population from the tree, not from a list

[b7n0de]

The problem, measured rather than argued

tests/test_never_raise_surface_family_property.py is the executable form of the never-raise class. It was green. It was also walking a hand-maintained list of 36 modules while the package ships 50.

Two identical planted defects, in throwaway copies of main @ ac0688c (no working tree was ever written to):

Plant	Module in _MODULES?	Result
raise in anchors.verify_anchors	yes	FAILED (errors=1) — caught
raise in anchors_ots.verify_opentimestamps	no	Ran 5 tests ... OK — not caught

The test is not broken. It is correct over the set it walks, and that set was smaller than the claim it carries. Eleven surfaces across seven modules matched the property's own name pattern and had never been entered. Discovery went from 81 to 90 surfaces once they were added.

What the corrected population found on its first run

emit.load_signer raised OSError: [Errno 9] Bad file descriptor. That is the worse half of the int case: open(9) does not fail on a wrong type, it reads file descriptor 9.

How much worse, measured after this PR was opened. The full-argument sweep that produced this finding crashed its own test process — OSError: [Errno 9] Bad file descriptor on stdout — because the fuzz had consumed the process's own descriptor. Demonstrated in isolation:

fremder fd 3, Offset 0
  open(3).read() -> b'GEHEIMER-SCHLUESSEL-INHALT'
  fd danach: GESCHLOSSEN (Bad file descriptor)

So load_signer(<int>) does three things, none of which is "raise on a wrong type": it reads the full contents of an arbitrary open file in the calling process, it hands those bytes to Ed25519PrivateKey.from_private_bytes(...), and it destroys the caller's descriptor on the way out. In a library whose subject is cryptographic evidence, an argument confusion that reads an arbitrary open file is a different category from an exception. The type floor is what stops it, and except OSError would not have.

Fixed with the type floor this repository already uses in evalcard and prereg (L1-01) — a typed error before the os boundary, not a wider except-tuple. The invariant existed here. It had never been applied to this surface because nothing ever asked.

A third axis of the same instrument

An exception that was neither _ACCEPTED nor _FORBIDDEN propagated straight out of the sweep loop. The test ended as ERROR and every surface after the offending one went untested. The taxonomy gap did not under-report — it stopped measuring, and the damage scaled with iteration position rather than severity: emit.load_signer sat at position 87 of 90, so three surfaces were lost. The same gap at position 1 would have cost 89.

Unclassified exceptions are now reported as escapes instead of aborting the sweep.

OSError joins _ACCEPTED, and that widening is measured, not guessed: across all 90 surfaces and the full corpus, an honest catch-all found zero forbidden escapes and exactly one unclassified case. A loader reporting "this path does not exist" is fail-closed and produces no verdict anyone could mistake for a pass; the contract forbids crashing instead of deciding, which is a different thing.

Why the guard is a separate file

A test cannot guard its own blind spot — it is the victim. test_never_raise_population_guard.py asks a different question: not "does every surface behave" but "does the population equal the tree". It imports _MODULES and _NAME_PATTERN from the property module rather than re-declaring them, because two copies of one truth drift and a drifted guard passes while the thing it guards is wrong. It carries its own discrimination test as well: a guard that cannot fail proves nothing.

Bidirectional evidence

Check	With the type floor	Without it (temporarily removed)
never-raise property	5 tests, OK	FAILED (failures=1)
population guard	3 tests, OK	—
full suite	Ran 2033 tests, OK (skipped=10)	—
ruff check .	clean	—

The green is the fix, not a coincidence.

Still open, declared rather than hidden

The argument axis. The sweep plays only the primary parameter. anchors_rfc3161.verify_rfc3161 raises AttributeError on a non-dict frozen or rp_trust — a violation of the very contract register_anchor_type prescribes to third-party authors — and it is still not reached by this property even after this PR. That is the finding the self-gate recorded as F2 on 31.07, and this PR does not close it.

Honest scope note: this PR is not part of the 3.8.0 release candidate (#140), whose delta is a single file. It targets main on its own.