feat(safety): phase 5 — loom model checking + invariant audit/assertion sweep

State machine extracted to src/slot_state.rs as a standalone unit (StateWord:
publish_queued / try_claim / yield_return / park_return / unpark / set_done /
reclaim, plus the Status view for cold paths). runtime.rs keeps the protocol
rationale and consumes the mechanism; every transition self-asserts its
precondition per the assert-the-invariants rule.

src/sync_shim.rs: std vs loom indirection (atomics + UnsafeCell with the
with/with_mut access API) for the two loom-modeled modules. Loom models run
the PRODUCTION code, not a replica:
- slot_state: no-lost-wakeup (park vs unpark), two-unparkers-one-enqueue,
  stale-unpark-never-hits-reused-slot (the ABA theorem), unpark-vs-claim.
- run_queue: mpmc exactly-once through a lap wraparound, push/pop race,
  striped two-producer drain.
RUSTFLAGS="--cfg loom" cargo test --lib --release — 7 models, all pass.
RawMutex deliberately not loom-modeled (futexes can't be; textbook mutex3
with stress + unwind coverage).

Assertion sweep (invariants now checked at the point of reliance):
- enqueue debug-asserts the word reads EXACTLY (gen, Queued) — the
  at-most-once-enqueued invariant the ring capacity proof leans on.
- RawMutex enforces the leaf rule mechanically: debug-build thread-local
  held-count, panics at the acquisition that violates it.
- live_actors underflow (double finalize) asserted.
- StateWord transition preconditions asserted (yield/park/done/reclaim/
  publish/claim).

Audit: with_runtime, RawMutex guards, run-queue ops, and trace::record all
gate preemption (and thereby the stop sentinel) for their span; trace was
already self-gating. Sole remaining exception is the channel std MutexGuard
— the documented first post-v0.5 fast-follow.

Review fixes to the branched-in work:
- slot_state::status_for mapped (matching gen, Vacant) to Stale instead of
  unreachable!: Pid::new is public, so a forged/never-issued pid (e.g.
  monitor(Pid::new(5,0)) on a fresh slab) could reach it — "no such actor"
  is the correct total answer; issued pids still can't get there.
- Tightened enqueue's assert from Status::Live to the exact (gen, Queued)
  word its own comment argues for.

Validated: 22 suites in debug (all asserts + leaf counter live) for
rq-mutex/rq-mpmc/rq-striped, release for rq-mutex, smarm-trace build +
stress, loom 7/7.

src/scheduler.rs

@@ -86,18 +86,19 @@ impl JoinHandle {
                 let slot = inner.slot_at(self.pid)
                     .expect("join: pid index out of range");
                 let mut cold = slot.cold.lock();
-                let w = slot.word();
-                // Our outstanding handle pins the slot: it cannot be
-                // reclaimed (generation cannot change) while we hold it.
-                assert_eq!(
-                    crate::runtime::word_gen(w), self.pid.generation(),
-                    "join: target slot has been reused"
-                );
-                if crate::runtime::word_state(w) == crate::runtime::ST_DONE {
-                    Some(cold.outcome.take().expect("Done slot must have outcome"))
-                } else {
-                    cold.waiters.push(me);
-                    None
+                match slot.status_for(self.pid) {
+                    // Our outstanding handle pins the slot: it cannot be
+                    // reclaimed (generation cannot change) while we hold it.
+                    crate::slot_state::Status::Stale => {
+                        panic!("join: target slot has been reused")
+                    }
+                    crate::slot_state::Status::Done => {
+                        Some(cold.outcome.take().expect("Done slot must have outcome"))
+                    }
+                    crate::slot_state::Status::Live => {
+                        cold.waiters.push(me);
+                        None
+                    }
                 }
             });
 
@@ -127,13 +128,14 @@ impl JoinHandle {
             let should_reclaim = match inner.slot_at(self.pid) {
                 Some(slot) => {
                     let mut cold = slot.cold.lock();
-                    if slot.generation() == self.pid.generation() {
-                        cold.outstanding_handles = cold.outstanding_handles.saturating_sub(1);
-                        cold.outstanding_handles == 0
-                            && crate::runtime::word_state(slot.word())
-                                == crate::runtime::ST_DONE
-                    } else {
-                        false
+                    match slot.status_for(self.pid) {
+                        crate::slot_state::Status::Stale => false,
+                        status => {
+                            cold.outstanding_handles =
+                                cold.outstanding_handles.saturating_sub(1);
+                            cold.outstanding_handles == 0
+                                && status == crate::slot_state::Status::Done
+                        }
                     }
                 }
                 None => false,
@@ -324,6 +326,10 @@ where
     let result = with_runtime(|inner| {
         let slot = inner.slot_at(me).expect("block_on_io: own slot vanished");
         let mut cold = slot.cold.lock();
+        debug_assert_eq!(
+            slot.generation(), me.generation(),
+            "block_on_io: own slot reused mid-park"
+        );
         cold.pending_io_result
             .take()
             .expect("block_on_io: resumed without a result")