feat(kernel-utils): narrowInterfaceGuard

[ci-belphegor]

Explanation

The algebraic heart of narrowing, and the PR that most deserves scrutiny — hence deliberately free of exos, promises, and provenance. A pure narrowInterfaceGuard({ name, baseGuard, delta }) => InterfaceGuard that conjoins each delta pattern onto the corresponding argument position, inherits arity, optional and rest positions and return guards verbatim, drops methods the delta does not name, and asyncifies every method guard.

Position i addresses the base's guard at i walking required arguments, then optionals, then the rest guard, and stays in whichever category it lands in. A delta cannot promote an optional to required and cannot change arity.

Dropping unlisted methods makes the safe outcome the default: forgetting a method removes authority rather than granting it.

Notes for reviewers

A position landing in the rest guard conjoins onto that one guard, and therefore constrains every trailing argument rather than only the position named — a rest guard is a single pattern, so per-position narrowing is unrepresentable there without changing arity. It stays ⊆ the base, and the surprise runs in the safe direction: the author gets less authority than intended, never more. Tested, and specified in the design doc.

An empty delta must be a no-op, not a narrowing. { readFile: [] } is defined as keeping a method entirely unchanged, so the claim soundness needs is ⊆, not ⊂.

The two "method not in methodGuards" errors are split on defaultGuards, which is a seam rather than a stylistic choice: a strict interface has defaultGuards: undefined, so the method genuinely does not exist, whereas a 'passable' interface admits it and merely guards it by default. PR 8 replaces only the second arm.

getGuardAt is deliberately not reused here. It maps a position to a guard, but narrowing has to write back into the category the position landed in; threading it through would have forced a non-null assertion or an unreachable undefined branch. Mapping over the base's own argGuards/optionalArgGuards makes the category boundary the loop bound, so it is the same walk with no duplicated logic.

Unmarks no ratchet cases.

Stack

PR 5 of 12. Base: #1050.