Fix remaining parser, face, module, and CI issues

[arena-ai-coding-agent]

Summary

• accept contextual total bindings and explicit empty match blocks
• preserve semicolons for final Python-face loop statements
• reject ambiguous glob/glob imports and align flattening order with the resolver
• root CLI module loading at the source file directory
• close the tracked Hypatia workflow/runtime findings with safety justifications and immutable action pinning

Validation

• git diff --check
• Full OCaml test/build gate is not runnable in this checkout because dune/opam are unavailable and the sandbox cannot reach Debian package mirrors.

Closes #682
Closes #683
Closes #743
Closes #644
Closes #655
Closes #642

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 283e450c-d315-4f26-8003-5d85b67ba7ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}