fix(codegen): descend through record fields when sorting machine layouts

[gertybotbot]

Closes the record-wrapped half ("Gap 1") of #2864. #2879 took Gap 2 (machine-in-machine); this is the other half, and the issue can close once both land.

⚠️ Stacked on #2879. The fix lives inside the dependency sort that #2879 introduces, so this branch contains that commit as its parent. Review/merge #2879 first; this diff is the 43-line descent on top of it.

The gap

register_machine_layouts sorts machines so a container is never sized against a still-opaque embedded machine. That walk looks for payload field types whose name resolves to a machine — but a record is not a machine, so it missed the lookup and stopped. A machine reached only through a record field was never registered as a dependency:

machine OuterG { state HoldingG { w: WrapG } ... }
type WrapG { inner: InnerG; }
machine InnerG { state ReadyG { payload: string } ... }

It fails SILENTLY — worse than Gap 2

Gap 2 segfaulted. This one produces no diagnostic, no output, and exit 1. Two programs with byte-for-byte identical token multisets, differing only in declaration order:

$ diff <(tr -s ' \n' '\n\n' <gap1.hew|sort) <(tr -s ' \n' '\n\n' <gap1_ctl.hew|sort)
IDENTICAL-TOKENS

$ hew run gap1_ctl.hew    # embedded declared first
gap1-payload              # rc=0

$ hew run gap1.hew        # container declared first
                          # rc=1, no stdout, no diagnostic

This is worth noting against #2864's claim that both gaps "fail closed ... do not miscompile". A silent empty exit-1 is arguably harder to diagnose than the segfault, since nothing points at layout at all.

Fix

collect_named_machine_deps now descends into a named type's record field types, keyed off pipeline.record_layouts (already threaded into codegen). A visiting stack guards recursion rather than trusting acyclicity — a malformed or indirect layout terminates instead of overflowing the stack.

Evidence

⚠️ Load-bearing: the tests are revert-verified to discriminate. With the record descent disabled and the tests kept, the container-first test FAILS while embedded-first still passes — so they test the fix, not merely its presence.

Both declaration orders are covered, each asserting the exact payload string so a zero-sized or misaligned payload fails rather than reading back an accidental value.

Green bare (exit codes read directly, not through a pipe):

• hew-codegen-rs — 755 tests, RC=0
• all 159 tests/hew/ files — 159 ok / 0 fail
• cargo fmt --all --check — RC=0 (caught a reflow pre-push; the lane that cost test(hew-cli): serialize wasm stdlib archive builds under the shared bootstrap lock #2874/feat(mir): implement clean_counter via faint-variable analysis #2878 a red run)
• cargo clippy -p hew-codegen-rs --all-targets -- -D warnings — RC=0, zero findings
• pre-existing machine_in_machine_test.hew and machine_in_record_test.hew both still green