feat(verify): discharge Creusot VCs end-to-end

Make `just verify` actually invoke Why3 + alt-ergo + z3 against every
Pearlite VC, and fix the mutant + miri pipelines along the way.

Verification crate
  - Drop the const-generic CAP types for EventQueue / TimerTable.
    Mirror with std::vec::Vec, whose creusot-std specs carry the
    proof burden. Capacity behavior is exercised by the runtime's
    own unit tests + correspondence tests.
  - View impls are #[logic(open)] over a pub field so contracts on
    push/pop/etc. can see the link to the inner Vec's @ view.
  - 14/14 VCs discharge: EventQueue {new, push, pop, is_empty, len,
    clear, Default}; TimerTable {new, len, is_empty, Default};
    Entry derives.
  - `cargo creusot prove --no-cache` always runs the SMT solvers;
    `time` shows ~7s CPU on ~1.2s wall-clock = real parallel work.

Tooling
  - verification/mise.toml pins nightly-2025-11-13 + rust-src,
    rustc-dev, llvm-tools-preview, rustfmt; declares opam, python,
    uv, and the project-local .venv. Inherits root mise.toml's just
    + cargo-* tools.
  - just verify clones creusot v0.9.0 to ~/.local/share/hsmc-verify/
    and runs the canonical ./INSTALL — that's the only way the
    bundled prelude-generator + creusot-rustc actually build.
  - just verify --no-cache forces SMT re-runs every time.
  - Drop bespoke pin/install of cargo-creusot from mise.toml; the
    cargo backend goes through cargo-binstall which can't pin a
    multi-bin git workspace at a tag.

Mutants — was missing every JournalSink mutant
  - Recipe runs with --features tokio,journal so journal_* and det_*
    tests (gated on both) actually execute.
  - Add clear_journal_empties_the_journal test in journal_smoke.rs
    to kill the JournalSink::clear with-() mutant.
  - Remove dead JournalSink::len + is_empty (called nowhere; only
    existed as mutation-bait).
  Result: 0 missed, 42 caught, 211 unviable (proc-macro emitted
  code that mutants can't standalone-compile).

Miri — was hitting the trybuild glob isolation issue
  - --exclude hsmc-macros (trybuild ui test isn't UB-relevant)
  - --exclude hsmc-verification (different pinned toolchain)
  - 66 tests pass under Miri, 0 UB.

Gitignore
  - /verif/, /why3find.json, /.why3find/, **/.venv/ — all
    regenerated by `just verify`. Repo stays clean of per-machine
    prover timings + venv artifacts.

Misc
  - Fix root-state targetability: `on(Trig) => <ChartName>;` resolves
    to root id 0 in both ir.rs::resolve_transitions and
    validate.rs's separate name_map.
  - `set shell` and `set script-interpreter` route every justfile
    recipe through `mise exec`, so all subshells see the right
    Rust + opam + cargo-* tools regardless of how `just` was
    invoked. No shebangs anywhere.

hsmc-macros/src/codegen.rs

@@ -30,12 +30,19 @@ fn compute_chart_hash(ir: &Ir) -> u64 {
     for s in &ir.states {
         feed(&s.id.to_le_bytes());
         feed(s.name.to_string().as_bytes());
-        feed(&[s.parent.unwrap_or(u16::MAX).to_le_bytes()[0], s.parent.unwrap_or(u16::MAX).to_le_bytes()[1]]);
+        feed(&[
+            s.parent.unwrap_or(u16::MAX).to_le_bytes()[0],
+            s.parent.unwrap_or(u16::MAX).to_le_bytes()[1],
+        ]);
         feed(&s.depth.to_le_bytes());
         feed(&s.default_child.unwrap_or(u16::MAX).to_le_bytes());
-        for &aid in &s.entries { feed(&aid.to_le_bytes()); }
+        for &aid in &s.entries {
+            feed(&aid.to_le_bytes());
+        }
         feed(&[0xee]); // separator: entries → exits
-        for &aid in &s.exits { feed(&aid.to_le_bytes()); }
+        for &aid in &s.exits {
+            feed(&aid.to_le_bytes());
+        }
         feed(&[0xff]); // separator: exits → handlers
         for h_ir in &s.handlers {
             match &h_ir.trigger {
@@ -63,7 +70,9 @@ fn compute_chart_hash(ir: &Ir) -> u64 {
             }
         }
         feed(&[0xfe]); // separator: handlers → timers
-        for &t in &s.owned_timers { feed(&t.to_le_bytes()); }
+        for &t in &s.owned_timers {
+            feed(&t.to_le_bytes());
+        }
         feed(&[0xfd]); // separator: timers → durings
         feed(&(s.durings.len() as u16).to_le_bytes());
     }