fix(ir): reject unsafe variables in negated body atoms (#920)

[justinjoy]

Fixes #920.

Problem

wirelog accepts a negated body atom that introduces a variable not bound by any positive body atom:

c(X) :- a(X), !b(X, Y).

Y appears only under negation, so its range is unbounded. IR lowering silently treated such a variable like a wildcard (setup_join_keys only keys on shared variables), so the program parsed, reported as stratified, and lowered to an ANTIJOIN. The result depended on whether any b("x", _) row existed — an unsafe Datalog rule that should be rejected.

Fix

Add a range-restriction (safety) check in the ANTIJOIN lowering (wirelog/ir/program.c): every named variable in a negated atom must also be bound by a positive body atom; otherwise the rule is rejected (return NULL → surfaces as WIRELOG_ERR_INVALID_IR, mirroring the existing negated-side-compound rejection).

build_atom_scan already normalizes wildcards and constants to NULL, so the check is exact and narrow:

• !b(X, _) (wildcard column) — safe, accepted.
• constant columns — safe, accepted.
• !b(X, Y) with Y unbound — unsafe, rejected.

The error message points at the supported workaround (project the negated relation to a key relation first).

Behavior

• Rejected (new): c(X) :- a(X), !b(X, Y).
• Accepted (safe form, from the issue): b_key(X) :- b(X, Y). c(X) :- a(X), !b_key(X).
• Unaffected: all existing negation usages are already safe — !superseded(id), !src_a(Id, _, _), !in_b(Id). Blast radius is zero.

Tests (TDD)

Written before the implementation:

• test_unsafe_negation_variable_rejected — the unsafe rule fails to build.
• test_safe_negation_via_projection_accepted — the projected-key form and wildcard columns build successfully.

Both added on the easy facade and mirrored on the advanced facade for the cross-facade test-parity gate (#785). The check lives in shared IR lowering, so both facades reject identically.

Validation

• RED confirmed: the unsafe test failed before the fix; the safe test already passed.
• GREEN: wirelog_easy, wirelog_advanced, and test_parity all pass.
• Full suite: 249 pass / 10 skip; the single failure is sbom_snapshot, a local-syft-version artifact unrelated to this change (no dependency is added).