test(merger): add LS-A-19 regression for exact resource-import lookup

[avrabe]

Summary

Closes the missing-regression gap for LS-A-19 that the LS-N verification gate (#161) surfaced on its first run. PR #156 fixed the imp.name.ends_with(rn) suffix-collision bug in Merger::add_unresolved_imports but landed without a dedicated regression test.

Refactors the dedup-skip path's inline .values().find(...) lookup into a private helper find_exact_resource_import_idx and adds three regression tests pinning the suffix-collision boundaries.

Why this matters

The bug: when two resources shared a suffix (float / bigfloat), the dedup-skip path's imp.name.ends_with("float") matched both [resource-rep]float AND [resource-rep]bigfloat. .find() returned whichever the HashMap iterated first (also LS-A-15 territory). The wrong import index got stored in resource_rep_by_component, routing subsequent float calls on the second component to the bigfloat import. Validator passes (both share (i32) -> i32); runtime sees bigfloat rep as float — type confusion with no trap (H-10).

Tests added

Test	What it pins
ls_a_19_exact_match_picks_float_not_bigfloat	Both names in tracking; exact match returns the right index regardless of HashMap iteration order
ls_a_19_no_match_returns_none_even_with_suffix_collision	Only bigfloat in tracking, ask for float → must return None (buggy ends_with would have returned bigfloat's index)
ls_a_19_resource_new_lookup_is_also_exact	Same case for the [resource-new] table

Gate impact

LS-N verification gate verdict moves from 15/19 verified (4 missing) → 16/19 verified (3 missing).

Remaining missing-bucket entries:

• LS-CP-4 (DWARF passthrough) — likely subsumed by DWARF / source-map remapping for fused output (witness MC/DC integration) #130 Phase 2 (DWARF Phase 2: address remap (#130) #143)
• LS-A-8 (HashMap rep_func selection)
• LS-A-9 (async callback POLL fallthrough)

End-to-end test for mythos-auto.yml

This is also the first real PR exercising mythos-auto.yml (added in #162). It touches a Tier-5 file (merger.rs), so the auto-runner should fire end-to-end:

1. Detect Tier-5 changes job passes the actor gate (avrabe)
2. Matrix runs claude-code-action on merger.rs with scripts/mythos/discover.md
3. Aggregate job posts sticky <!-- mythos-auto-gate --> comment
4. If NO_FINDINGS, auto-applies mythos-pass-done label

Watching for: budget consumption per single-file scan, sticky-comment markdown rendering, label-application timing.

🤖 Generated with Claude Code

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/merger.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[github-actions]

LS-N verification gate

⚠️ 16/19 verified — 3 missing regression tests

	count
Passed (≥1 test, all green)	16
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	3

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-CP-4
• LS-A-8
• LS-A-9

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}