Three taint tags, race detection and overflow checks in the type system

Secret is now a first-class compile-time taint tag alongside PersonalData<T> (E0302) and Untrusted<T> (E0303): a secret reaching any sink that does not declare a Secret parameter, a log line, print, a string concat into a DSN, is E0316. Comparing a secret with == is E0317, because byte-by-byte equality short-circuits and leaks how many leading bytes matched (CWE-208); the fix is secret_equals or secure_compare, which always inspect every byte. A whole-program pass now builds the call graph from every spawn/spawn_thread and rejects a scalar or struct module global written from a thread-reachable function as E0309, a compile-time data race.

Integer +/-/* are overflow-checked by default (CWE-190): the compiler lowers them to LLVM overflow intrinsics and traps with the operands named; code that wants modular arithmetic says so with wrapping_add. The security review also closed two escapes: the raw __syscall intrinsic, which let a zero-capability program do arbitrary I/O, is now gated on Cap<Unsafe>; and a taint launder via tuple projection is closed in the typechecker. Both are macOS-verified and pinned by negative tests.