feat(codegen): surface &T / &mut T as SharedBorrow / ExclBorrow (closes #221)

[hyperpolymath]

Summary

• Extends Ty::Borrow and ExprKind::Borrow with mutable: bool (mirrored on the Surface* enums); parser recognises &mut via a mut_marker atomic rule + mut keyword.
• Adds ty_to_ownership_kind helper that maps &T → SharedBorrow, &mut T → ExclBorrow, linear Ref/String → Linear, else Unrestricted. Replaces UserFnInfo.param_linear: Vec<bool> with param_kinds: Vec<OwnershipKind>.
• emit_ownership_section broadens its filter from "any linear" to "any non-Unrestricted" so shared-borrow-only signatures still emit an entry.
• s-expr IR encoder uses borrow vs borrow-mut discriminator atoms to preserve mutability through the IR round-trip.

Closes the producer-side gap flagged in both 2026-05-30 reviews of typed-wasm proposal 0001 — SharedBorrow + ExclBorrow were defined in ownership.rs but never emitted, so the verifier's L7 alias-exclusion check fired zero times against ephapax-emitted modules.

Test plan

• cargo test --workspace green (all suites)
• test_parse_mut_borrow — &mut x parses with mutable: true
• ownership_section_emits_shared_borrow_for_borrow_param
• ownership_section_emits_excl_borrow_for_mut_borrow_param
• Existing ownership round-trip + linear-param tests unchanged and green
• Example examples/linear/16-shared-vs-exclusive-borrow.eph demonstrates both polarities

Out of scope

• Mutability is currently passed unchecked from parser → AST → codegen; the linear/affine checkers walk borrow children but don't yet enforce alias-exclusion at compile time. The verifier-side L7 check (typed-wasm) now has signal to enforce; ephapax-side static enforcement is a follow-up.

Closes #221.

🤖 Generated with Claude Code