…nistic and constant-time

Two independent fixes to the strict-execution-order cross-chunk link pass:

- add_transitive_esm_init_depended_symbols iterated an FxHashMap via values(),
  whose bucket order follows FxHash layout. FxHash is unseeded but hashes
  differently on 32-bit vs 64-bit, so that order (which flows into the chunk's
  depended_symbols FxIndexSet and thence into imported-symbol $1/$2 rename order
  in deconflict_chunk_symbols) could diverge between native and wasm32/WASI
  builds. Iterate sorted by the owning StmtInfoIdx to pin one order everywhere.

- module_is_in_live_chunk did a linear chunk.modules.contains scan, called for
  every canonical referenced symbol of every included statement under strict,
  making the pass quadratic on large chunks. Replace with an O(1)
  module_to_chunk + liveness check. Sound because add_module_to_chunk sets both
  together and every module-removal site pairs the removal with clearing
  module_to_chunk, reassigning it to the destination chunk, or marking the chunk
  Removed; no site leaves module_to_chunk pointed at a still-live chunk that no
  longer contains the module, so no removed-module set is needed.

…der strict order

The emergent-cycle projector's soundness rests on mirroring the linker's three
init registration paths. One consumption disjunct
(referenced_symbols_by_entry_point_chunk) has no projection counterpart, so a
future projector hole would surface only as a fuzzer-caught
`init_* is not a function` runtime crash.

Add a debug-only, strict-gated check that re-runs Tarjan over the FINAL
imports_from_other_chunks chunk graph and asserts the exact obligation
close_cyclic_chunk_members discharges: every module hosted in a nontrivial SCC
(>=2 chunks, or a self-loop) that is both order-sensitive AND order-wrap-eligible
is order-wrapped in the plan. This turns any future under-projection into a
deterministic debug/CI build failure instead of a runtime crash. It is a
structural invariant like the existing empty-facade zero-static-indegree assert,
not the internal semantic verifier design.md rejects.

The obligation is deliberately is_order_sensitive && is_order_wrap_eligible, not
raw is_order_wrap_eligible: a side-effect-free, import-free eligible leaf (e.g.
`export const x = 1`) is never wrapped by the projector, yet can be co-hosted in
a chunk that lands in a cycle because of its siblings' cross-chunk imports, and
leaving it unwrapped is correct. Reuses is_order_sensitive and
is_order_wrap_eligible (visibility widened to pub(super)) instead of duplicating
their conditions. Zero fixtures trip the assert; zero snapshot changes.