[STUBGEN] Classify native layouts from reflected byte facts

[Seven-Streams]

[STUBGEN] Classify native layouts from reflected byte facts

Summary

Add a language-neutral classifier that decides, for every registered object type, whether its native layout can be reproduced from reflection (complete) or not (opaque), with the byte evidence behind each verdict. tvm-ffi-stubgen --coverage-out <json> writes the verdicts as a report. No generator is attached.

Motivation

A native-struct backend can hold an object by value only when it can reproduce the C++ layout byte for byte. The registry already publishes what that needs: each type's own sizeof (#720) and every field's size, alignment and offset. A wrong complete is a struct with the wrong layout, a wrong opaque only costs a C ABI call per field, so the classifier deserves a review of its own before any generator builds on it.

Changes

• stub/layout.py (new). One criterion: the reflected fields must fill [parent.total_size, total_size) exactly, allowing only the gaps alignment forces. Two prerequisites: the type has metadata of its own (layout-unknown) and its parent is complete (parent-opaque). Unexplained bytes are uncovered-bytes; a field starting before the cursor is field-overlap. Polymorphism is not a rule: a vptr makes the fields fall short of sizeof on its own. Two target-language rules are injection points: field_renderable and forced_opaque, the latter only demoting a type that would otherwise be complete.
• stub/cli.py, stub/utils.py: --coverage-out <json>, usable without PATH arguments. The report fixes the language-neutral keys; a generator adds its own under a per-type "target" key.
• testing.cc: TestCxxClassHiddenField (an unreflected member) and TestCxxClassPolymorphic (a vptr), so both failure paths run in CI.

Testing

tests/python/test_stub_layout.py: every verdict path on synthetic byte facts, then the real registry. The TestCxxClass* chain is complete with padding [36, 40), [52, 56), [73, 80); TestCxxClassHiddenField reports [32, 40) uncovered; TestCxxClassPolymorphic reports sizeof 40 against fields ending at 32; ffi.Function is layout-unknown; ffi.Module is opaque like the polymorphic fixture. The CLI writes the report with --coverage-out alone.