feat(fasl): ANSI compile-file + compile-file-pathname; FUNCLFA v3 header carries a build-id gateVerified

cl:compile-file is now the public producer over the ADR-0029/0030
fasl machinery: (compile-file "foo.lisp") writes foo.funclfa (or
:output-file), returns (values output-truename warnings-p failure-p);
compile-file-pathname computes the default output path (asdf's
compile-file* plans caches through it).  load — both the REPL arm and
the runtime function asdf's load* calls — now dispatches on content
magic, so a fasl loads as a fasl programmatically.

FUNCLFA v3: the header carries sha256(/proc/self/exe) — the same
identity the FUNCLIMG gate uses (ADR 0014 D7) — and the loader
REFUSES a mismatch ("FASL BUILD-ID MISMATCH: recompile against this
binary") instead of replaying stale bytes into the wrong baked world:
a fasl is only valid against the exact image that compiled it, and a
stale cache after make build would reproduce the cave#302..#309
identity-split class from a single file.  Verified: same-binary
cross-session compile+load round-trips (defun/defvar/defmacro all
live); a tampered id byte fails loud with no replay.

Two implementation traps recorded in the code: read-fd-into-bv does
NOT append (it reads from 0 and SETS the length — a read-until-EOF
loop zeroed the buffer at EOF and hashed ""), and the sha digest
helper returns a length-0 bv (ag-bv-equal compares lengths first).

Gates: (compile-file "asdf.lisp") + fresh-session load + load-system
alexandria green end to end; test-fast-sharded ALL 8 SHARDS PASSED;
spike oracle green; --hosted 42; fixed point held.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>