regen's copy loop skipped a declared row naming nothing; a corrupt row was inert, now it refuses

[briansrls]

copy_hand_maintained_support iterated HAND_MAINTAINED_STAGE0_FILES and
HAND_MAINTAINED_STAGE0_DIRS with a bare if exists / if is_dir and no else, so a
declared crate-layout row naming a path that is not on disk was silently skipped. That
is an absorbing fallback in DESIGN §5's exact shape: the failure arm widened (copy what
resolves, ignore what does not) instead of refusing, so the deficit's frequency was zero
by construction.

WHAT IT MADE INERT, with a live specimen. On integration/namespace-cut,
dag/gunbc/stage0_crate_layout_generated.dag carries a stray "rs", row between
"shared_typecheck_store.rs" and "recorded_fixture.rs" — 37 entries against main's 36 —
introduced by merge commit ebda683 ("Integrate main (#8788)"), where a line split and
its tail survived as its own list element. Nothing named rs is on disk, so the copy
loop skipped it without a word, and because the emitted mirror faithfully reproduces the
corrupted authority, regen's fixed point reports green over it (that branch's own
6d9f239: "regen fixed point green (exit 0)"). Regen compares mirror to authority and
has no operand for whether the authority is right — but the authority CAN be joined to
the tree, every declared basename either resolves or does not, and this is the one place
that join already happened and its result was discarded.

BOTH LOOPS, and the second is not a copy of the first. The file loop's absence is absence
from disk, which is never legitimate. Note the contrast with verify_hand_maintained,
which iterates the same list and also continues on absence: its absence is absence from
the EMITTED population, the ordinary case for 35 of the 36 entries. Two functions, one
list, two different absences, and only one of them is normal.

EVIDENCE, per DESIGN §5 — green by execution plus a discriminating red. The new test
plants every declared row on disk and accepts, then removes exactly one file and one
directory, so control and refusal differ by a single row and the refusal must name it.
Verified red without the wall by two independently constructed controls (the impl arms
removed; and origin/main's body carrying only the new test), both failing with "a
declared row naming no file must refuse". Verified against main's live population first:
all 36 declared files and both declared dirs resolve on origin/main, so the wall is green
on main by measurement rather than by assumption.

Rung: mechanically preventable — basename: String and List<String> throughout, so
"rs" is a well-formed inhabitant and no type error is available. Next-rung trigger: a
Stage0Filename carrier minted only from a path that resolves, which would make the corrupt
row unwritable rather than refused.

v1 admission: the seed is semantics-frozen and maintenance-active, and this serves the v2
self-host program — a corrupt crate-layout authority silently accepted is a self-host
correctness gap. Same class as the bare-Err(_) arms swift-lynx-327 is converting in
gunbc#9087, ~14k lines away in this file.