model: ctrl#1533 phase-1 follow-up — M-B carrier-cost facts on PrimitiveContract + M-D name-interning declarations

[briansrls]

Summary

ctrl#1533 phase-1 follow-up: the two fact families deferred from #4660 — M-B (per-primitive carrier-cost facts) and M-D (name-interning facts). Model-only, no host behavior changes; this completes the phase-1 modeling so the phase-2 host carrier swap and phase-3 interning/positional-records land as implementations of declared facts.

• M-B — carrier-cost facts (dsl/std/primitives.dag): PrimitiveContract gains carrier_cost: CarrierCostSensitivity = CarrierInsensitive | CarrierSensitive { ephemeral_work, persistent_work }. Per the M7 single-authority note in ctrl#1533, the facts live on the existing contract data values — no parallel cost table. 12 primitives are carrier-sensitive: the five mutation primitives the proposal names (map_insert, map_merge, list_push, concat, append) plus with (record update — host-implemented as a map merge; Record sharing was 12.7 MB in the phase-0 receipts) and six reads whose cost the carrier changes (map_get, map_contains_key, lookup, get, first, last) — the read extension follows directly from M-A's CarrierCost.lookup_work. The remaining 49 contracts are explicitly CarrierInsensitive. The ephemeral arms are what the v2 interpreter does today (copy-before-update — the quadratic term phase 0 measured); the persistent arms agree with the M-A carrier declarations (log32 n HAMT / log n RRB) and are what phase 2 must implement. The existing work/output_size fields keep their historical convention (ownership-aware emitted-code path).
• M-D — name-interning facts (src/v4/std/value_carrier.dag): type/variant/field names are drawn from closed, compile-time-known sets (M4: closed sets are enums, not strings) — declared as NameDomain (🟢 terminal) + three NameInterningDeclaration data values naming each domain's authority (the resolved graph's declared name set) and the host representation duty (interned_symbol_id; field names additionally positional_slot_in_declared_field_order). The positional-record layout — the largest per-instance saving in the phase-0 receipts (31.8K un-interned Strings) — thereby derives from a declared fact rather than being a hand-rolled optimization. v4.std.runtime already encodes the fact structurally (RuntimeFieldValue.field: Symbol); the v2 host's owned-String names are the implementation gap phase 3 closes.
• New executable witness: name_interning_covers_all_domains_holds (one declaration per NameDomain arm) with co-located discovery registration — the suite is now 8/8 green.

Both new coproducts (CarrierCostSensitivity, NameDomain) carry 🟢 terminal Practice-4 marks with pattern-by-pattern justification.

This completes phase 1 of ctrl#1533. Next: phase 2 (host carrier swap — HAMT/RRB behind the Value enum surface, gated on the value_carrier_laws witnesses staying green plus the phase-0 measurement delta) and phase 3 (interning + positional records, implementing M-D), independent of each other per the proposal.

Test plan

• claim_batch --entry src/v4/test/claim/std_grounding/value_carrier_laws.dag --functions <all 8> --claim-run — 8/8 PASS.
• M-B typecheck/resolution verified by execution: a throwaway claim entry importing std.primitives matched map_insert_contract/list_push_contract/fold_contract carrier_cost payloads — PASS (entry not committed; M-B facts are dsl/std-side and outside the v4-only smoke runner's source root).
• cargo test -p v2-compiler-tests -- shared_primitives_parses_strict — ok (the strict-parse gate covering dsl/std/primitives.dag).
• python3 scripts/check_v4_layering_imports.py — OK.
• No Rust changes; the only Rust test reading dsl/std/primitives.dag (t_impossiblebugs_unenumerated_effects_test) asserts a contains("filesystem_read_contract") that is unaffected.