Source annotations: post-module header attachment law; finish M1C-1 jwt/self-application binding

[gunbai-bot]

Follow-on to #7955, closing the module-header attachment defect found by review 49881 (and re-found on this branch by reviews 49976 and 50039): the module-level prose that M1C-1 self-applied was placed where the documented binder law binds it to the first module member, not the module.

What this PR does

Attachment law — post-module header blocks now bind to the module, structurally.

• A // block on the line immediately after the module declaration, ending before the first module item, attaches to the module. A blank line after the module line opts out: the block then follows the ordinary nearest-following rule (witnessed both ways).
• Two new facts are observed at capture (the same pattern, and the same reason, as the existing preceded_by_blank_line): preceded_by_annotation_line — the previous line is itself a standalone annotation line — and module_root on the subject roster — the realization declares which subject IS the module rather than the fold guessing it structurally.
• Block continuation is now structural: a block's subject is decided by its first line; continuation lines merge by observed adjacency (pending_adjacent in the attach fold), and a continuation of a refused line falls back to being judged on its own rather than riding into an older open block.

Why not the smaller fixes reviews proposed. Review 50039 suggested dropping the + 12 byte window alone; executed evidence refutes that: with the bare removal, the adjacent second line of a blank-separated block below the module falls into the gap arm and splits the block (w_adjacent_comment_lines_form_one_block goes red). The + 12 window itself was the smuggled-heuristic class DESIGN §5 forbids — it under-covered long dotted module names and only masked the continuation bug when the module name was short. Identifying the module as "earliest subject by span start" was the same class one level up: the synthetic attachment fixture (gamma between f and g) proves any roster whose earliest subject is an ordinary member would misbind. Both heuristics are replaced by declared/observed facts.

jwt.dag layout fixed. The blank line between module extdeps.auth.jwt and its module annotation is removed, so the migrated verification-boundary prose actually binds to the module under the law above.

Witness coverage (v1_annotation_binding_test, 16 executing witnesses): single-line and multi-line post-module headers, module-name-length independence (the exact shape the + 12 window under-covered), blank-separated opt-out, two-line body block refusing both lines, plus all pre-existing M1A behavior. The subject-map receipt (tools/m1c1_subject_map_receipt.txt) is regenerated by execution over the real files — the previous receipt was hand-authored and its MODULE rows were false on main.

Suites run

• v1_annotation_binding_test — 16/16 PASS (recipe in-file)
• v1_annotation_round_trip_test, v1_annotation_capture_test, v1_annotation_erasure_test, v1_annotation_target_emission_test, source_annotation_attachment_witness_test — 15/15, 6/6, 9/9, 1/1, 11/11 PASS
• regen_stage0 --verify — divergence 0 (seed regenerated from the edited .dag)

[gunbai-bot]

Addressing the three module-header attachment reviews together, all fixed at head 1c7244748a:

• review 49881 (M1C-1: self-apply source annotations and finish jwt.dag #7955) and review 49976: confirmed and fixed. The migrated module prose did bind to the first member. The receipt that claimed MODULE bindings was hand-authored; it is now produced by execution (see the header of tools/m1c1_subject_map_receipt.txt), and the executed run also caught one more instance the reviews missed — annotation_bind.dag's second header paragraph binding to an import — fixed by merging the paragraphs into one adjacent block.
• review 50039: the + 12 window is removed, and the requested two-line post-module witness added (w_multi_line_module_header_stays_one_module_block). One correction to that review's analysis, established by execution rather than argument: dropping the window alone is not sufficient — with the bare removal, the adjacent second line of a blank-separated block below the module falls into the gap arm and splits the block (w_adjacent_comment_lines_form_one_block goes red; preceded_by_blank_line covers only the block's first line). The fix therefore adds an observed preceded_by_annotation_line bit and makes block continuation structural (a block's subject is its first line's subject). The review's own framing — a heuristic where a grounded bound exists — also applied to identifying the module as earliest-subject-by-start, so the roster now declares module_root instead.

Binding suite 16/16, round-trip 15/15, capture 6/6, erasure 9/9, target-emission 1/1, synthetic attachment 11/11, regen_stage0 --verify divergence 0.

— sent from fierce-pike-375