chore: DWARF / witness mapping discovery for fused output (sub-#130)

[avrabe]

Summary

• Discovery oracle + 5-test fixture for the witness MC/DC integration epic (DWARF / source-map remapping for fused output (witness MC/DC integration) #130). Pins today's lossy DWARF passthrough behaviour as a green-to-red signal for Phase 2 (DWARF Phase 2: address remap (#130) #143).
• No production code changes; defaults unchanged. The test file lives at meld-core/tests/dwarf_passthrough.rs.

Rebased + refreshed for Phase 1.5 (post-#135)

Original draft sat for 16 days while Phase 1.5 (PR #135, commit c7a2c0b) flipped the default DWARF policy from PassThrough to Strip. The fixup commit on this branch:

1. Adds the new dwarf_handling field to both helper builders.
2. Renames fuse_default → fuse_passthrough — the discovery oracle was never "whatever default does", it was "pin passthrough for Phase 2 to flip".
3. Re-purposes the original current_default_is_merge_not_drop test (which asserted the pre-1.5 default) to current_default_is_strip_post_phase_1_5 (post-1.5 reality + future-flip canary).
4. Updates docstrings to reflect Phase 1.5 as shipped rather than upcoming.

5/5 discovery tests pass; full meld-core lib suite is 236/236.

What the test pins

DWARF sections at top level of fused module: {
    ".debug_abbrev": 2,  ".debug_info": 2,  ".debug_line": 2,
    ".debug_loc": 2,     ".debug_ranges": 2, ".debug_str": 2,
}
input  code-section length (sum across embedded modules): 231531 bytes
fused  code-section length:                                213242 bytes

(Numbers from tests/wit_bindgen/fixtures/lists.wasm; duplicate sections per the buggy passthrough; addresses inside encoded against the input's old code section.)

Audit findings (committed in the test docstring + filed in #130)

• FuserConfig::default().dwarf_handling is now DwarfHandling::Strip (Phase 1.5). To exercise the passthrough path you must opt in via dwarf_handling: DwarfHandling::PassThrough.
• merger.rs:2010-2012 naively concatenates per-module custom_sections with no dedup or rewriting.
• lib.rs::encode_output (line 1390 area) emits all of them unless Drop is configured OR Strip removes them.
• No code anywhere in meld-core/src/ parses or rewrites .debug_* content.
• Component-level custom sections are dropped at parse time; only core-module custom sections flow through.

Cross-repo dependency: witness

pulseengine/witness v0.11.x is the consumer that breaks under PassThrough. It uses gimli (crates/witness-core/src/decisions.rs) to build a (code-section byte offset) -> (file, line) map for MC/DC attribution. The DWARF passed through by meld today (when PassThrough is opted-into) gives gimli wrong + duplicated input.

Witness is intentionally NOT a meld-core dependency. End-to-end "run witness on a fused module and check coverage" lives in the cross-repo integration story; this PR is the meld-side discovery oracle.

Test plan

• CI green (Format, Clippy, Test, Coverage, Bench, Fuzz, Mythos gate, LS-N gate)
• Mythos auto-runner: this PR adds a new TEST file, not a Tier-5 source file — detect job will set any=false and matrix-scan will skip. Next Tier-5 PR (likely Phase 2 DWARF Phase 2: address remap (#130) #143's actual remap code) gets the full auto-runner test.

Sequencing post-merge

• This PR (Phase 1 discovery) → land
• Phase 2 (DWARF Phase 2: address remap (#130) #143) DWARF address remap → flips assertions in this test from green-to-red, motivating the remap code
• Phase 3 (DWARF Phase 3: synthetic DIEs for adapter / inlined code (#130) #144) synthetic DIEs for adapter / inlined code

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

⚠️ 16/19 verified — 3 missing regression tests

	count
Passed (≥1 test, all green)	16
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	3

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-CP-4
• LS-A-8
• LS-A-9

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}