journal + determinism tests + Creusot verification scaffolding

Phase 1 — semantics doc
  docs/002. hsmc-semantics-formal.md

Phase 2 — deterministic execution journal
  hsmc/src/journal.rs (TraceEvent, JournalSink, ActionKind)
  hsmc-macros: __chart_journal! emission at every observable site
    (entry/exit/action/transition/timer arm-cancel-fire/during/emit/
    event delivery/terminate). Per-state during count helpers, stable
    chart-hash via FNV-1a. Action observation moved out of run_action
    and into call sites so ActionKind is accurate.
  Public API on the generated machine: journal(), take_journal(),
    clear_journal(), CHART_HASH.

Phase 3 — verification crate (Creusot scaffolding)
  verification/{Cargo.toml,mise.toml,requirements.txt,INVARIANTS.md}
  verification/src/{event_queue.rs,timer_table.rs} — Pearlite
    contracts on simplified mirrors of the runtime types. cargo
    creusot generates Coma IR cleanly; VCs not yet discharged.
  Correspondence tests drive the verified mirror and the runtime
    type with the same op sequences and assert observable parity.

Tests — 113 deterministic-flow tests across 22 files. Each compares a
  hand-built expected journal byte-for-byte against actual, anchored
  to a spec section: initial entry, lateral/self/up transitions,
  bubbling, timers, emit, ordering, durings, step/dispatch
  equivalence, root-targeting, current_state, termination.

Tooling — mise.toml (root): stable Rust + cargo subcommands.
  verification/mise.toml: pinned nightly-2025-11-13 + opam + python
  venv + uv. just verify is fully self-installing.

Bug fix — root state targetable by the chart's own name (e.g.
  `on(Trig) => ChartName;`) per spec §"How transitions work".

CHART_HASH — stable FNV-1a fingerprint over the chart's structural
  definition; mismatch on replay = different chart.

hsmc-macros/src/validate.rs

@@ -25,12 +25,17 @@ pub fn validate(ir: &Ir) -> syn::Result<()> {
     // Resolve transitions: done already? We need post-build resolution.
     // We'll do it here because we need IR mutable; but we're given &Ir.
     // Instead perform target lookup inline.
-    let name_map: HashMap<String, u16> = ir
+    let mut name_map: HashMap<String, u16> = ir
         .states
         .iter()
         .filter(|s| s.name != "__Root")
         .map(|s| (s.name.to_string(), s.id))
         .collect();
+    // Per spec: the root state is targetable as a transition destination
+    // by the chart's own name.
+    if let Some(root) = ir.states.iter().find(|s| s.parent.is_none()) {
+        name_map.insert(ir.name.to_string(), root.id);
+    }
 
     for s in &ir.states {
         // Empty state (not root). A state with a `during:` is not empty —