[pointer] Make TransmuteFrom cast-relative

[joshlf]

Alternative to #3699.

Fix #3691 with the same exact metadata-aware byte-representation witness as #3699, while also extending the pointer transmute trait hierarchy to model shrinking mutable casts directly at compile time.

The core distinction is:

• TransmuteFrom<Src, SV, DV, C> proves projection validity: every SV-admissible Src state projects through the address-preserving cast C to a DV-admissible destination state. C may shrink.
• Src: SpliceFrom<Dst, SV, DV, C> proves write-back validity: starting from any SV-admissible Src state, replacing exactly C's destination bytes with any DV-admissible Dst state leaves the enclosing Src SV-admissible.

The latter is the compile-time theorem needed for an &mut Src -> &mut Dst shrinking transmute. No inverse cast or runtime repair is involved; the untouched source bytes remain part of the proof context.

This PR:

• makes TransmuteFrom cast-relative and permits address-preserving shrinking casts rather than quantifying over arbitrary equally-sized referents;
• adds SpliceFrom as the source-validity preservation relation for writes through a projected/mutated destination;
• teaches TryTransmuteFromPtr / TransmuteFromPtr / MutationCompatible to compose those two static relations with the existing access/aliasing proofs;
• keeps shared coexistence as the separate SharedCompatible obligation;
• keeps Validity defined over complete referent byte states, including initialization state;
• restores the stronger private ByteReprEq witness from [pointer] Use metadata-aware representation proof in transmute helper #3699 for the byte-trait delegation macro. That stronger witness is intentionally separate: SpliceFrom assumes an already-valid source place and therefore is not sufficient to prove type-level traits such as FromBytes for an otherwise possibly-uninhabited type;
• fixes impl_for_transmute_from! using the exact metadata-aware ByteReprEq mapping, including delegating TryFromBytes::is_safe through that exact correspondence.

For an exact cast, SpliceFrom reduces to the familiar reverse-validity preservation obligation. For a shrinking cast it is strictly more general: it quantifies over valid writes to the destination subrange while preserving the untouched source bytes.

This is a concrete refinement of #3703 focused on compile-time transmutability modeling. #3699 remains unchanged as the narrower macro-only alternative.

Fixes #3691.

Authored by an AI agent acting on Josh Liebow-Feeser's behalf.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.91%. Comparing base (a06acb0) to head (3594f08).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3705      +/-   ##
==========================================
+ Coverage   91.90%   91.91%   +0.01%     
==========================================
  Files          20       20              
  Lines        6175     6183       +8     
==========================================
+ Hits         5675     5683       +8     
  Misses        500      500              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.