feat(api): expose recorded identifier and nested-value provenance

[e54-bot]

Summary

Fixes #324. Fixes #325.

Exposes identifier provenance through new public Program accessors and records the previously missing identifier spans in the raw Workshop parser, so every source position that names a variable or subroutine carries an exact span.

• global_variable_name_span / player_variable_name_span / subroutine_name_span return the declared-name span of each declaration: an attached name_span when a provider supplies one via set_*_spans, else the recorded declaration span, which raw parses store as the name itself.
• action_identifier_span returns the recorded span of the variable or subroutine an action names: a set/modify/for target or a Call Subroutine callee. Indexed ... Variable At Index writes lower to calls and record the name on their variable argument, reachable through action_argument_value_span.
• rule_name_span returns the span of the name inside a rule's rule("name") string; rule_event_name_span returns the subroutine name a Subroutine event binding names.
• condition_value_span / action_argument_value_span return the recorded span of a value nested inside a condition or action argument, addressed by a child path into the public Value tree; variable and subroutine references return their recorded identifier span.
• ProgramProvenance keeps a ValueProvenance tree per condition and action argument plus an identifier per action; to_wir writes nested spans and identifiers back so diagnostics and dumps keep them.
• The raw parser records identifier spans for declarations, set/modify/for targets, Call Subroutine/Start Rule callees, Subroutine event bindings, ... At Index name arguments, and Global.name/Global Variable(name)/Event Player.name/bare-name reads; wir::Event::Subroutine carries name_span, variable actions carry target_span/callee_span, and ValueNode carries an identifier slot validated like every other span.
• SourceMap format is unchanged; nested-value and action-identifier mappings remain outside mapped-text-v1, and no set_* method exists for identifier-level provenance.

Test plan

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --all-targets
• cargo run -p workshop-rs --bin workshop-catalog-gen -- check
• git diff --check
• program_model integration test slices source text through every accessor: declarations, set/modify/for targets, infix and indexed writes, Call Subroutine/Start Rule/Subroutine event names, Global Variable()/Player Variable()/bare-name/parenthesized reads, multi-word names, and string/comment lookalikes that must not resolve as identifiers

[e54-bot]

Independent review of 13044ac — rust-engineering pass over the provenance plumbing and API contract, plus a test-design pass over the new tests.

Rust engineering

ValueProvenance.children ↔ public Value child order verified for all 13 wir::Value variants; action_identifier/apply_action_source cover exactly the six identifier-bearing WIR variants; Disabled recursion surfaces inner-action provenance correctly; shape guards still drop displaced spans; source_map apply writes only .span (nested/identifier mappings stay outside mapped-text-v1, documented); name_span.or(span) fallback verified defensible (raw parses store the name in span). One finding:

1. program.rs:378-387 + docs/source-preservation.md — action_identifier_span enumerates "set/modify and for-variable actions" as identifier-bearing, but for-variable actions can never return a span: ForGlobalVariable.target_span is never populated by the parser and ForPlayerVariable has no such field. The None enumeration omits them, leaving the coverage ambiguous between "names an identifier" and "other action forms always return None."

Test design

All four new tests verdict keep — each protects a distinct contract at the smallest surface. Findings:

2. Vector child paths 0/1/2 documented but never asserted — a transposed or missing Vector arm in wir_value_children would pass.
3. PlayerVariable player child traversed but never observed — [0,0,0]→None is satisfied even if the PlayerVariable arm is omitted.
4. Set Player Variable(Event Player, playerScore, 7) in IDENTIFIER_SOURCE has no assertion — a distinct recording boundary (standard player form) left unobserved.
5. Control-flow provenance plumbing untested — Disabled wrapping is the trickiest path (public position ↔ inner action provenance) and nothing exercises it.
6. Out-of-range argument index uncovered.
7. Recording-boundary None/keyword assertions correctly describe current parser coverage but don't mark it as pending #325, so a reader may treat them as permanent contract.

Findings are being addressed in a follow-up commit on this branch.

[e54-bot]

Review findings addressed and pushed:

• ee50ca2 — test coverage: Vector component path [2] → "3", PlayerVariable player child [0,0] → "Event Player", standard Set Player Variable boundary None, disabled Modify Global Variable(...) provenance through the wrapper → "playerScore", out-of-range argument index None; recording-boundary None assertions now marked as current parser coverage pending Record identifier spans in the raw Workshop parser #325.
• 657dcda — docs: action_identifier_span and docs/source-preservation.md now list For variable loops among the forms that record no identifier.

Verified: cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --test integration program_model (17/17) all green. Ready for follow-up review.