codegen: the facts' interval of an int32 local reaches the range proofs, and a key they bound to int32 is lowered as its i32 - #14453

Second PR of the typed-set lane (on top of #14450, which typed set$sig(i32[-128,255], i32[-8,7])). The typed body
still ran its integer work in doubles:

const old = this.at(square);                                      // facts: old is i32 [-8,7]
this.hashA ^= this.zobristA[(old + 6) * 128 + square] ?? 0;        // key: vaddsd, vmulsd, vaddsd, call normalize
this.board[square] = piece;                                        // at rest: key i32 → double → fcmp ×3 → fptosi

wpfacts proves an interval for each of old, piece and square, but exported only "this local is an int32"
(ElisionFacts::int32_inputs), and a typed body seeded only parameters whose interval starts at 0. Codegen's range
proofs (range_facts::int_range_expr) therefore knew nothing about a signed int32 local, so:

• a key built from such locals was no proven integer index: a double chain, then
  perry_array_index_normalize_i32 (a call) in the runtime-key arm;
• an at-rest element site keyed by a signed I32 parameter took the double-key form (form=f64);

What changes

• The interval is exported (ElisionFacts::int32_ranges, from BindingFacts::int_range; the perry driver
  fills it beside int32_inputs). No wpfacts change: the fact existed.
• A proven int32 let reads its interval (range_facts::facts_local_range): the last resort of
  int_range_for_local, after every local proof (a loop fact, an alias, a constant, the parameter summary). The
  interval is whole-life (every value the local ever holds), so it needs no dominating guard. Only a let of
  FnCtx::facts_int32_locals (not boxed, no module global), in a body that uses the facts.
• A typed body's I32 parameters start with their signature interval (signature_entry::param_range_facts,
  seeded into FnCtx::int_range_facts under a scope no loop ends): T1's nonnegative_params, generalised to any
  sign. Written parameters are demoted by plan selection and seed nothing.
• A key the range proofs bound to int32 is lowered as its i32 (expr/int32_key.rs): the runtime-key element
  read (index_get) and the runtime-key store (index_set) lower such a key with lower_expr_as_i32 (its i32
  chain, exact because the chain's result is in int32 and below 2^53 at every step) and hand it to the canonical
  split as a native key. The split's unsigned bound (N10) declines a negative key onto the arm that reads the
  original value, as for any native key. At-rest sites take the int32 form through the same range
  (rest_elems::int32_key already asked int_range_expr).

Switch, probe, witness, sabotage

• PERRY_FACTS_LOCAL_RANGES=0 (off, false): none of the above (main's lowering). Compile-cache input
  (compile_env.rs, test local_ranges_switch_is_a_cache_input).
• Probes: PERRY_REST_DIAG=1 shows the at-rest forms (form=f64 → form=i32 / form=rep); # rep … range= in
  PERRY_FACTS_DUMP is the interval read.
• Check mode (PERRY_VERIFY_FACTS=1): the store witness of a proven int32 let
  (facts_int32_locals::witness_exact) also tests that the stored value lies in the interval the range proofs
  read ("int32 input", exit 86). A typed parameter's interval is witnessed at every typed site and at the boxed
  entry (P2's witness_value, unchanged).
• S0 arm local-range-negative (PERRY_FACTS_SABOTAGE=localrange: the interval claimed is its lower bound
  alone): correct rc 0, sabotaged rc 86, predicate int32 input.

Results

Chess (qb10, instructions:u M, one build, on vs PERRY_FACTS_LOCAL_RANGES=0, twice each, identical runs,
checksums and PV equal in every arm). Build y1 = c96e5d4, the PR's code on main 7523aa7 (#14450); the PR head adds the merge of main
6d3cd78, not re-measured:

Before merging main (build x2, on main e4f004e + #14450's branch): 20 466.3 / 467.5 / 1 429.9 / 678.7 vs
21 360.0 / 490.7 / 1 487.8 / 700.5 (−4.18 / −4.73 / −3.89 / −3.11%). The parts, on that base: the interval alone
(no key lowering, build x1) −1.12 / −1.22 / 0 / −0.83%; the key lowering adds the rest, and all of evaluate.

Per function, search 250000 (perf record -e instructions:u, --debug-symbols builds, M = sample share × total):

In set's body the Zobrist key is now shl $7, old; lea 0x300(square, old) in place of vaddsd; vmulsd; vaddsd; call perry_array_index_normalize_i32, and the board read is cmp $0x80, square; jae cold; load in place of the
double-key test. At-rest forms (PERRY_REST_DIAG): set$sig read form=rep, store form=i32 (off: both
form=f64); make$sig's at(captureSquare) form=rep; unmake$sig 4 of its 5 stores form=i32 (off: 2).
In evaluate the normalizer is no longer sampled (9.4 M off): its keys built from int32 lets are i32 chains.

Peak RSS (/usr/bin/time %M, KiB, 5 runs each, y1): search 26 880 ×5 both arms; perft 19 456 (one 19 200
off); evaluate 19 456 (one 19 200 off); legal 19 456 (one 18 944 each). Equal.

Where else it engages: the parity IR census was stopped part way (owner order: no long gates): of 2 473
programs compared, 79 change IR, none of them changes output or compile rc. tssrc: no proven site lost or gained;
the three.js skin is byte-equal in every section.

Gates

qb10, on vs PERRY_FACTS_LOCAL_RANGES=0, build y1 = c96e5d4 (the PR head's code on main 7523aa7). The PR head 2cab0e0 adds only the merge
of main 6d3cd78 (clean; 11 commits in transform, EH and JSON), not re-measured. Pre-merge builds x1 / x2 where a row says so.

Not done

See FOLLOWUPS "[typed set follow-ups]":

• a field read call of an at-rest Array in an int context (const old = this.at(square)) still tests ?? 0 on a
  double on the hit path;
• this.hashA ^= x reads the I32 lane as a double and runs the guarded ToInt32 on it. Telling
  is_known_i32_range that an I32 lane read and a present at-rest element read are int32 changed nothing on chess
  (20 465.9 vs 20 466.4 M on search), so it is not in this PR: the compound assignment takes another path;
• the Zobrist tables are ordinary Arrays; unmake's undo.captureSquare store keeps the double key (a double
  field).