Spec-compliant UTF transcoding + working list<conditional-pointer>
adapters + a process fix that closes the v0.9–v0.10 whole-file-scan
treadmill. 3 PRs since v0.10.0:

## Headline

- **#181 — mythos-auto diff-scoped scanning.** Each Tier-5 PR is now
  judged on the diff it introduces, not on every latent bug in the
  whole file. The scan step computes
  `git diff --no-color BASE...HEAD -- $F` per touched file, writes
  it to `mythos-diffs/`, and instructs the AI to report only
  findings *introduced* by the diff. v0.10's whole-file scan
  surfaced 4+ pre-existing findings on every parser.rs PR plus a
  reproducible false positive (the auto-runner's claimed inversion
  of LS-P-8 against `canonical-abi.py::record_size`); diff-scoped
  scanning eliminates that whole class of churn while preserving
  the LS-N gate's coverage of approved scenarios.

- **#182 — UTF transcoders emit U+FFFD on malformed input.** v0.10
  closed two cross-memory leaks by trapping (`unreachable`):
  LS-P-16 (UTF-16→UTF-8 lone high surrogate at end-of-input would
  have read 2 bytes past the buffer) and LS-P-19 (UTF-8→UTF-16
  truncated multi-byte lead would have read 1–3 bytes past). The
  trap was conservative but spec-incorrect; the Canonical ABI
  mandates lossy replacement. All four sites (LS-P-16 ×1,
  LS-P-19 ×3 for the 2/3/4-byte branches) now substitute U+FFFD
  (3-byte UTF-8 `EF BF BD` / single UTF-16 BMP code unit) and
  consume only the lead, falling through to the existing
  encoder. Fused adapters produce spec-compliant output for
  malformed UTF instead of refusing to run.

- **#183 — LS-P-12 + LS-P-18 structural per-element conditional
  pointer fixup.** v0.10 panicked at adapter generation when an
  outer list's element type contained a pointer-bearing
  option/result/variant payload (e.g. `list<option<string>>`,
  `list<result<string, E>>`, `list<variant{ …(string)… }>`, plus
  the LS-P-18 mixed-record bypass). v0.11 ships the proper fix:
  `CopyLayout::Elements.inner_pointers` becomes `Vec<InnerPointer>`
  carrying a `guards: Vec<DiscriminantGuard>` chain per
  descriptor; `element_inner_pointers` recurses into
  Option/Result/Variant payloads threading the enclosing
  discriminant onto the chain; the FACT adapter's per-element
  fixup AND-evaluates each guard at the per-element base + offset
  before firing realloc + memory.copy + ptr-rewrite, wrapping the
  body in an `If` that fires only when every enclosing arm
  holds. Common WIT shapes (`list<option<string>>` for nullable
  string lists, etc.) now generate correct cross-component
  adapters.

## Test coverage

- 266 lib tests
- LS-N verification gate: 33/33 approved scenarios
- mythos-auto delta-pass: clean diff-scoped per-file scans on
  parser.rs / fact.rs / resolver.rs
- LS-P-12 / LS-P-18 regressions upgraded from `#[should_panic]`
  to structural assertions that pin the guarded `InnerPointer`
  shape (option-Some / Result-Ok / mixed-record both-pointers
  cases).

Co-authored-by: Claude Opus 4.7 <[email protected]>