refactor(ir): give the shared document walk one home

[OmarAlJarrah]

Summary

Three pieces of document-inspection mechanism were written more than once across
pass, ir/irverify and compilers/compile, because there was no package below
all three to hold them. There is one: ir is Layer 0, imports only the stdlib,
and already owns traversal.

One walk. The bounded, cycle-guarded reflection walk existed twice — 141
lines in pass/refs.go, 128 in ir/irverify/refs.go — with mapEntry and
orderedEntries byte-for-byte identical and the rest the same logic spelled
twice: the pointer/struct/sequence/map arms, the embedded-field path rule, the
depth cap and its rationale, and the byte-slice skip. Both comments already
cross-referenced the other to say the two had to agree.

It is now ir.WalkValues, with ir.MaxWalkDepth and ir.MapKeySuffix beside
it. irverify's visit(v, path) bool signature is the one that survived, since it
subsumes pass's isRef predicate and per-struct hook — both are closures over
one visitor now, and neither package keeps a walker of its own.

One isNilTypeDef. It existed three times with identical bodies. It asks a
question about ir.TypeDef, so it is ir.IsNilTypeDef.

One registry derivation. irverify.refKindByType enumerated the
registry-bearing ID classes by hand and needed TestStringTypes_AreAllClassified
to stop it drifting; pass.documentRegistries derived the same set from
Document's own shape. The derivation moves to ir.DocumentRegistries, both
checkers use it, and the hand-written table and its guard test are deleted. A
registry added to Document is now checked by both the moment it exists.

Behaviour is unchanged: same codes, same messages, same paths, same ordering. No
golden or conformance fixture moved.

Truncated walks are no longer silent (#55)

checkNaming discarded its walk-truncation flag, and so did checkIndices,
checkProvenance and checkRawPayloads — the reference walk was the only one
that reported anything. That was benign by coincidence rather than by design: a
pruning walk reaches a subset of what the unpruned reference walk reaches, so the
reference walk trips the cap first. The coincidence holds only until the
reference walk gains pruning of its own, and a walk over a document nested past
the cap would then check a prefix of the names and say nothing about the rest.

Every walking check now returns the flag, and Verify folds them into a single
ir/walk-truncated violation — a too-deep document is one fact about the
document, not one fact per walk that noticed it. A drift guard holds the shape
from both sides: a function that calls ir.WalkValues must hand a bool back to
its caller, and a function shaped like a walking check must appear in the list
Verify runs.

This is the last open item on #55. Item 1 (forEachGroupOperation truncating
silently) was fixed in #136 and item 3 (TestIR_NoFloatFields hand-maintaining
the kind list) in #149, so the issue closes here.

Deliberately out of scope

The integer-index carriers — Service.Servers, Channel.Servers,
HTTPBinding.SuccessStatus — stay enumerated by hand in both checkers. Nothing
can derive them: an index is an int like any other and reflection has nothing
to key on, which is the reason the two checks exist separately in the first
place. integerFields in ir/irverify/indices_test.go remains the guard that
fails when the IR grows an integer field nobody has classified, and the code now
says so where a reader will reach it.

Test plan

• gofmt -l, go vet ./..., golangci-lint run (0 issues), ./scripts/check-coverage.sh — 100% of 4466 statements.
• The walk's guarantees are now tested where the walk lives (ir/walk_test.go), rather than once per copy. Each guarantee was proven by planting the defect and watching the test redden:
  • byte-sequence skip removed → TestWalkValues_ByteSequencesAreNotDescendedInto
  • cycle guard removed → TestWalkValues_SharedPointerIsDescendedIntoOnce, TestWalkValues_CyclicPointerGraphTerminates
  • map entries left in Go's iteration order → TestWalkValues_MapEntriesAreVisitedInRenderedKeyOrder
  • embedded-field elision removed → TestWalkValues_PathsSpellFieldsIndicesAndKeys
  • key.PkgPath() == "" dropped from the registry derivation → TestDocumentRegistries_DerivedFromDocumentShape
  • typed nil unscreened → TestIsNilTypeDef_ScreensBothSpellingsOfNil
• The truncation fix likewise: restoring checkNaming's dropped flag reddens TestWalkChecks_EachReportsTruncation, and making Verify swallow every flag reddens TestVerify_ReportsTruncationOnce.
• The drift guard was checked against both additions it advertises catching: a planted function that walks without returning a bool, and a planted check-shaped function absent from the list — each fails with the message naming it.