Make Rust emitter deterministic: correct variant owner-selection + sort import keys

[gunbai-bot]

What

Three non-determinism/correctness sources in the v1 Rust emitter, all fixed:

1. `variant_to_enum` HashMap owner-selection (`v1_compiler_infer.rs`): `variant_fold` iterated `env.bindings` (HashMap) without sorting, so the first-processed enum for a shared variant name varied per-process. Fixed by alpha-sorting `env.bindings` values before folding, and selecting the correct owner using `imported_variants` (built from the source module's locally-defined items, not the full transitive `type_env.bindings`).

2. `map_keys` on exported HashMap (`v1_compiler_emit_rust.rs`): three call-sites (`reexport_parents`, `wildcard_import_pool_surface_names`, `wildcard_reexport_surface_names`) iterated `HashMap::keys()` non-deterministically, producing non-deterministic USE statement ordering. Fixed by sorting each key-vec before iteration.

3. `find_struct_name_by_fields` record disambiguation (`v1_compiler_emit_rust.rs`): when multiple struct types share the same field names (e.g. `AnthropicModelSpec` and `OpenAiModelSpec` both have `model, model_id, context_window, max_output_tokens`), the previous sort-by-name fallback was deterministic but semantically wrong — it always picked `AnthropicModelSpec` for both modules, emitting `AnthropicModelSpec { model: OpenAiModel::Gpt4o }` = invalid Rust. Fixed by building `field_type_hints` (field_name → inferred value type) at the call site and filtering candidates by type compatibility before falling back to alpha sort.

Why the correct-owner fix matters (DESIGN §7)

The `ApiKey` variant appears in two coproducts:

• `AuthScope = None | FilesystemPerms | ApiKey | NetworkAcl` (defined in `std.cache_interface`)
• `AuthScheme = Bearer | Header | Basic | ApiKey` (defined in `std.types`, transits in via `std.cache_interface`)

`buildbuddy.dag` imports `ApiKey` from `std.cache_interface`. The correct owner is `AuthScope`.
With alphabetical sort alone, `AuthScheme` (h < o) would win — emitting `AuthScheme::ApiKey` where `AuthScope` is expected = compile error. So determinism alone would have frozen a real §3 bug (deterministic-but-wrong).

The fix: `imported_variants` uses only locally-defined items of the source module (via `parent_tm.items`) to build the variant→unique-owner map. This ensures `AuthScope` wins because `AuthScheme` is not locally defined in `std.cache_interface` — only `AuthScope` is.

Residual: PosixSubject / FileOwnership

`PosixSubject { uid: Int, gid: Int }` and `FileOwnership { uid: Int, gid: Int }` are distinct named Rust types with identical field names and identical field types — full-signature matching cannot distinguish them, so alpha sort applies. This is latent-safe (corpus builds green, no current construction site forces one into a field typed as the other), NOT structurally-impossible. If such a site appeared — e.g. a field typed `PosixSubject` constructed with a `FileOwnership` literal — it would be a live compile error, same trap as `AnthropicModelSpec/OpenAiModelSpec`. Precise §5 framing: wall-after-grounding, not never. The two types are a §3 nicknaming candidate for a future de-collision.

.dag authority follow-up (known, not fixed here)

This fix lives in the hand-maintained v1 Rust seed (`v1_compiler_infer.rs`, `v1_compiler_emit_rust.rs`) because `regen --verify` is deferred and the stage0 is hand-synced (see `regen_verify_gate.dag`). When regen un-defers (§7 fixed-point dissolution / v2 self-host), the same determinism + correct-owner-selection + field-type-disambiguation logic must be ported to the `.dag` emitter model or it will regress on regen. Tied to the §7 fixed-point trigger.

Oracle results (run locally on HEAD 12ff922)

Double-emit (609 dsl modules, 616 files): diff -r emit1 emit2 → EMPTY (deterministic)

Semantic correctness checks:

• `extdeps_llm_anthropic.rs`: only `AnthropicModelSpec` constructors ✓
• `extdeps_llm_openai.rs`: only `OpenAiModelSpec` constructors ✓
• `extdeps_cache_buildbuddy.rs`: `AuthScope::ApiKey` ✓
• `extdeps_cache_github_actions.rs`: `AuthScope::ApiKey` ✓

Discriminating witness

`variant_owner_disambiguation_test::shared_variant_resolves_to_locally_defined_owner_not_transitive` — verifies that `ZLocalOwner::SharedV` is emitted (not `ATransitiveOwner::SharedV`). Designed so the wrong owner sorts alphabetically first; confirmed RED on revert.

[gunbai-bot]

Corroborating baseline non-determinism witness from #5884 lane.

While verifying a separate PR (#5884, func_env.sigs dedup), I ran the unmodified origin/main gunbc binary 3 times over the same 619-file dsl corpus and diffed all 3 pairs. Union S = 50 files that ever differed across those 3 runs — independent confirmation of the same families this PR fixes:

• ProviderKeyEncoding ↔ CatalogProviderKeyEncoding
• AuthScheme::ApiKey ↔ AuthScope::ApiKey (your buildbuddy/sccache witness)
• OpenAiModelSpec ↔ AnthropicModelSpec
• CacheWriteSemantics ↔ AtomicityModel
• pub use line-ordering

This is an independent repro from a different binary build, different PR context, same 50-file non-deterministic universe. The variant families match yours exactly. May help as additional evidence for reviewers.