feat: validate declaration headers before MIR lowering

[sanohiro]

Summary

• validate extern, imported, stored-function, main, local-header, summary, and structural drop-set metadata before MIR publication;
• carry normalized imported FnEffect through checked HIR and strip it into an explicit six-field MIR imported record;
• replace the overloaded HIR origin fields with FnOrigin, preserving existing per-unit exportability and ABI behavior;
• add fail-closed four-entrypoint owner matrices, deep-header coverage, interface effect-tag rejection, and the mir-header-validation benchmark row.

Verification

• cargo build --workspace --locked
• scripts/test-pr.sh
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo check -p align_mir --tests --locked
• release bench/library_boundary provenance run with the LLVM 22 toolchain

The pre-PR gate was recorded by scripts/pre-pr.sh against the final HEAD. On this macOS host,
DYLD_SHARED_REGION=private stalls test-binary startup in _dyld_start; the successful gate used
the explicit LLVM 22 paths without that variable.