fix(stdlib/E4): route reflection/literal/value/match bare-type sites through the non-transitive gate

attempt-3 closed the leaf + parameterized-head leaks but several more
sites still resolved an UNQUALIFIED type name via the global
type_alias_map / findByName / type_bridge.resolveAstType without the
single-hop visibility gate, so a 2-flat-hop bare type leaked through:

  - resolveTypeArg (reflection / size_of / align_of / type_name / type_eq):
    identifier + type_expr leaves now gate via headTypeLeak; the wrapped /
    structural forms (*T, [N]T, []T, ?T, fn-ptr, tuple) route through the
    already-gated resolveTypeWithBindings so each inner leaf recurses the
    source-aware resolveNominalLeaf.
  - resolveTupleLiteralTypeArg: each element leaf is resolved through the
    source-aware resolver before the delegated build, so (COnly, s64) is
    gated.
  - resolveArrayLiteralType (T.[...] typed array/vector-literal head):
    identifier + type_expr leaves gate via headTypeLeak.
  - type-as-value lowerExpr identifier (x: Type = COnly, x == COnly).
  - type-category match arm (case COnly:).

Qualified ns.X / 1-hop / source-pinned library-internal references stay
exempt (the gate falls through for reachable / unauthored names, and
returns the existing "unresolved type" diagnostic for genuinely-undeclared
names). README notes the type gate holds wherever a bare type name is
named. New regressions 0765 (2-hop reject) / 0766 (1-hop pass).

readme.md

@@ -411,7 +411,10 @@ gated exactly like a bare leaf type — the constructor head must be reachable o
 your own or a direct flat import, not two hops away. A bare reference to a
 namespaced-only import's member — function, module constant, or **type** (leaf or
 generic head) — is likewise not visible and is rejected (`type 'X' is not visible;
-#import the module that declares it`); qualify it as `m.name`. (A library's own *internal* type references still resolve: a generic
+#import the module that declares it`); qualify it as `m.name`. The type gate holds
+wherever a bare type name is named — a value/field annotation, a reflection /
+type-arg slot (`size_of(T)`, `size_of(*T)`), a typed array-literal head (`T.[…]`),
+or a type-as-value / type-match arm — not just plain annotations. (A library's own *internal* type references still resolve: a generic
 struct / pack fn / protocol body is instantiated in the module that defines it, so
 e.g. `List(T).append`'s `alloc: Allocator` is visible there regardless of the call
 site.)