InputEnvelope: first-class bounded input for WorkDemand + CI corpus instance

[briansrls]

Summary

Models the InputEnvelope as a first-class fact on WorkDemand, mirroring DescentEvidence from std/induction.dag. An unbounded input is the data-side of a non-terminating Loop; a WorkDemand without a declared input ceiling is therefore fail-open by construction. BoundedInput is the declared ceiling (analog of Strict); EnvelopeUnknown is the honest fail-closed bottom (analog of DescentUnknown).

What changed

• InputSizeAxis closed enum: WitnessCount | SourceNodeCount | CorpusNodeCount
• InputBound record: axis: InputSizeAxis, max: Measure<Count, One, Nat>
• InputEnvelope coproduct: BoundedInput { bounds: List<InputBound> } | EnvelopeUnknown
• AdmissionVerdict: Admitted | RefusedOverEnvelope { axis } | RefusedUndeclared
• input_admitted fn: EnvelopeUnknown => RefusedUndeclared; undeclared axis and over-ceiling both => RefusedOverEnvelope; all within => Admitted
• WorkDemand.input_envelope required field added; all 4 existing WorkDemand data declarations updated to carry EnvelopeUnknown (honest: ceiling not yet declared)
• gunbc_ci_corpus_envelope: CI corpus as first BoundedInput instance (P1 scaffold — ceilings are operator-set operating-point values, NOT derived quantities; P2 derives them)
• input_envelope_admission_test.dag: 6 test functions, all green by execution
• input_envelope_roadmap.dag: grounds the P1/P2 plan as a .dag Plan authority

Ceiling values (P1 scaffold — operator sign-off needed before P2 locks them)

Axis	Ceiling value	Disposition
WitnessCount	2000	Scaffold — operator-set ceiling, not derived
SourceNodeCount	500000	Scaffold — operator-set ceiling, not derived
CorpusNodeCount	5000000	Scaffold — operator-set ceiling, not derived

Test plan

# All 6 test fns run green by execution:
./target/release/gunbc run --source-root dsl --source-root src/v2 \
  --entry dsl/test/claim/input_envelope_admission_test.dag \
  --function admitted_when_actual_at_envelope --claim-run   # true
./target/release/gunbc run ... --function refused_when_actual_over_envelope --claim-run   # true
./target/release/gunbc run ... --function refused_when_actual_axis_not_declared --claim-run  # true
./target/release/gunbc run ... --function refused_undeclared_when_envelope_unknown --claim-run  # true
./target/release/gunbc run ... --function red_on_revert_bound_change --claim-run  # true
./target/release/gunbc run ... --function ci_corpus_envelope_is_bounded --claim-run  # true

# Full compile: 604 files emitted, 0 diagnostics
./target/release/gunbc compile --output-dir /tmp/out --dependency-pool-index primary-precedence \
  --source-root dsl --source-root src/v2

Kept draft: ceiling values need operator sign-off before locking (per brief from sharp-stag-782).