Ship a per-release surface manifest with stable ids and refusal codes

- packages/compiler/surface-manifest.json is generated (pnpm manifest), committed, and shipped in @scriptc/compiler; entries project mechanically from the diagnostics registry, the unsupported-syntax dispatch tables, the stdlib/builtin lowering tables, and the supported-builtin-module list
- every non-static entry carries the SC code the compiler raises for it, and the version spine is the exact published release version
- FENCE_CODES joins the diagnostics registry so factory-minted construct fences are enumerable
- the sampling harness compiles listed-static probes and asserts each sampled non-static entry refuses with exactly its listed code, beside a byte-identical staleness guard
- the release workflow regenerates the manifest, fails on drift, and attaches it to the GitHub release

package.json

@@ -11,6 +11,7 @@
     "test:cache-identity": "node tests/harness/cache-identity.mjs",
     "test:watch": "vitest",
     "lint": "eslint packages/compiler/src packages/cli/src",
+    "manifest": "tsx scripts/surface-manifest.mjs",
     "scriptc": "tsx packages/cli/src/main.ts"
   },
   "devDependencies": {