Observe shell binding refusal before artifact emission

[gunbai-bot]

Fix the remaining rust-unit-tests red after the #9886/#10017 merge sequence.

The shell output-key control was still looking for refusal text inside src/probe.rs, but binding refusals now stop emission and correctly withhold that artifact. The control now reads the typed diagnostic through diagnostic_to_message, asserts the unknown key and modeled-channel cause, and asserts that the refused compile emits no files. This is a rung climb over the old string scrape: it establishes both a typed refusal and artifact withholding instead of requiring refusal prose inside a file that should not exist.

Both stage0 projections were regenerated from the .dag authority. The first regenerated projection decoded byte-for-byte to the installed test body (1,925 bytes each, empty diff), and required regen then reported first_generation_equal=true with planned=150 executed=150 adjudicated=150.

The sibling render_rust_applied_type_routes_qualified_base_through_leaf_name failure was already repaired on main by #10017, which restored #9983’s observed unit-variant census in the stage0 control. This PR does not change or weaken that test; it is included below as a positive verification that the upstream repair remains green.

Verification:

• /opt/cargo/bin/cargo test --release -p v1-compiler --lib shell_service_unmodeled_output_key_refuses -- --nocapture
• /opt/cargo/bin/cargo test --release -p v1-compiler --lib render_rust_applied_type_routes_qualified_base_through_leaf_name -- --nocapture
• target/release/claim_executor --required-regen --source-root dag --source-root src/v2 (first_generation_equal=true, 150/150/150)
• decoded projection vs installed fixture: empty diff, 1,925 bytes each
• cargo fmt --all --check
• git diff --check

[gunbai-bot]

Addressed review 58553 in 621b597 by regenerating v1_compiler_compiler_tests_rust.rs from the .dag authority. The regenerated concat now keeps .any(...) open across both conjuncts. I decoded its literals and diffed the resulting 1,925-byte fixture against compiler_tests.rs; the diff is empty. A subsequent required-regen pass reports first_generation_equal=true, planned=150 executed=150 adjudicated=150.

The PR body now also states that #10017 already repaired the sibling render_rust_applied_type control on main, and describes this change as the stronger typed-refusal plus artifact-withholding control it is.

[gunbai-bot]

Closing as superseded by #10025. That converging change repaired the same class on main: the control matches CompilerDiagnostic::TransportEmissionNotModeled, verifies the missing-realization fact names the authored key, and asserts the refused operation emits no module. After integrating main, this branch changes zero bytes (merge-tree equals the main tree), so merging it would be a no-op rather than an additional implementation.

The finding was resolved, not abandoned; two independent lanes converged on the same typed-refusal and artifact-withholding correction.