Add the type-erased arg-parser runtime kernel with property tests

[Smaug123]

Stacked on #565. Part of the arg-parser rewrite working towards discriminated-union (sum) argument schemas.

What this is

ArgParserRuntime is the future core of the generated argument parser: a pure, type-erased kernel that knows nothing about target types, only the shape of a schema (names, arity, repeatability, requiredness) and raw string tokens. It has three phases, all data-to-data:

• scan — tokenizes argv into an ordered ScanEvent log (occurrences, positionals, errors, help, separator), preserving the historical grammar: greedy value consumption, boolean-like keys consuming only boolean literals, --no- negation, unknown-key laziness under [<PositionalArgs true>], and the Arg parser: a bare -- no longer discards pending parser state #563 rule that -- resolves pending state exactly like end-of-input.
• select — chooses a case for every Sum node from which leaves were observed: exactly one touched case wins; two is a conflict; zero falls back to the unique case satisfiable with no arguments.
• validate — missing-required / inactive-leaf / no-positional-sink structural errors, plus the list of leaves whose defaults must fire.

Because selection is shape-first (never depends on value conversion), the typed layer that will follow — converters, defaults, record assembly, message rendering — cannot change which argument a token was routed to nor which union case is selected. That is what will make it safe to embed this file verbatim into generated output (no runtime dependency) with only thin generated code per type.

Nothing consumes this yet: the generator cutover is the next PR.

The interesting part: the tests

The exhaustive reference semantics is implemented in the test suite: expand every Sum into its complete alternatives (P × (A + B) = P×A + P×B) and accept precisely those alternatives whose leaf set covers everything observed and whose required leaves were all observed; exactly one accepted alternative is a parse. FsCheck properties (with instrumented distribution assertions, so the tests fail if the generators stop exploring the interesting regimes):

• select ≡ exhaustive expansion over random schema trees (fuzzed sum/product bias) and observed-sets biased from valid towards noisy/empty (fuzzed drop/optional/noise percentages), 2000 cases: unique-alternative ⟺ compositional accepts with identical choices and active leaves; zero alternatives ⟹ compositional errors; multiple ⟹ reported as ambiguity.
• Scanning is lossless: unscan (scan args) = args for arbitrary token lists drawn from a mixed adversarial distribution (well/ill-formed keys, bool literals, separators, =-pathologies, unicode) — every input token is accounted for in exactly one event.
• Trailing -- appends exactly a Separator event (the Arg parser: a bare -- no longer discards pending parser state #563 property, at the core level).
• Round trip: rendering a random assignment through random syntax choices (= vs space, case flips, negation, bare flags with lookahead-aware fallback) scans to exactly the intended event list.

Plus unit tests pinning the token grammar and the motivating DU example (--foo=3 vs --bar=8 --baz=9; --foo=3 --bar=8 is a conflict; --bar=8 selects BarCase and reports missing --baz).

🤖 Generated with Claude Code

[Smaug123]

Codex reviewed clean, by the way. Still got to use my human eyes.

[Smaug123]

Suggested change

	/// True if this error means "stop the parse immediately" (historically these were
	/// exceptions thrown mid-scan rather than accumulated).
	/// True if this error means "stop the parse immediately".

[Smaug123]

Suggested change

	/// The grammar (deliberately preserving the historical parser's behaviour):
	/// The grammar:

[Smaug123]

I think this is a bug in Fantomas, by the way.