feat(verified): invalidation frontier over the use graph (Phase A of #6655)

[gHashTag]

Closes #6673
Refs #6655. Stacked on #6671; this PR's base is that branch.

What

specs/verified/frontier.t27 (module VerifiedFrontier, use verified::reuse;). It makes one pass over the nodes in topological order and gives each one REUSE or the first reason it must be rebuilt.

• A node's closure part is DIFF when any of its imports was not reused.
• An edge that is forward, points at its own node or is out of range gives MISSING, so the node is rebuilt. An edge nobody could check never produces a reuse.

The edges come from the existing use graph (specs/ci/affected.t27 / t27c deps-tree); nothing is re-parsed.

Evidence

Run on the Railway lab with t27c built from master 1c0299f59:

Check	Result
t27c gen ... && zig test	All 9 tests passed.
gen-verilog, gen-c	exit 0
t27c seal --verify	all hashes MATCH
Mutants	5/5 killed: forward check dropped, j > i off by one, rebuilt flag never set, edge direction reversed, count doubled

The tests use a diamond with a bystander. Shared base changed: 1 of 5 reused. Leaf changed: 4 of 5. One side changed: 3 of 5. Toolchain changed: 0 of 5. These are outputs of the model on that fixture, not measurements of real build time.

Next

Feed it the real use edges and seal parts of two versions of one spec. That is the software half of #6656.

🤖 Generated with Claude Code

[gHashTag]

The spec-guards failure is inherited from master, not caused by this PR. Master's last 5 runs fail the same way, including 1c0299f59 and bfef3231a, with ring-096-rust DRIFTED against specs/numeric/formats.t27 (5 signatures). It is tracked in #5746 and #6553. This PR touches only specs/verified/** and its seal; no ring names those files.