chore - 1480 oven_store and oven_rustc are crates

[dannymeijer]

Summary

The Oven ring becomes crates, and Oven stops knowing what Incan is. Two halves.

The inversions. On dev.5 src/oven reached into the compiler in exactly two ways, and both now arrive as data. The compiler's identity — INCAN_VERSION and SDK_PROVIDER_CODEGEN_REVISION, read by the store's release-domain pruning and the Loaf baker's provenance — is oven_model::compiler_identity::CompilerIdentity, handed in by OvenStore::with_release, OvenLoafBakerContext and OvenLegacyCargoPrepareRequest. The provider facts — where the SDK provider root is, what the inventory file is called, how staged provider digests are refreshed, and what a packaged provider looks like on disk — are the four methods of oven_store::OvenProviderHooks, carried as Arc<dyn OvenProviderHooks> by the same requests and read by digest_dependency_specs; NoProviderHooks is the test double. src/oven_facet.rs in the root is Incan's answer to both: compiler_identity(), provider_hooks() and IncanProviderHooks, which is where the three SDK-staging functions that read the inventory went. The Cargo tree-digest cluster (648 lines) and ProviderArtifactDigestError moved below the frontend into oven_model::digest, because workspace_authority needed it and the frontend's artifact.rs only re-exports it. After this, grep -r 'crate::(frontend|provider|library_manifest|version|driver|cli)' src/oven is empty.

The split. loaves/oven/oven_store is src/oven.rs — the receipt model, whole — as its crate root, with store, store_mirror, closure_proof, progress and process. loaves/oven/oven_rustc is rustc/, loaf/, loaf_mirror, plan/, native_test/, native_contract, interop and legacy_cargo/ with the Loaf fixtures, one strongly connected component on dev.5, and depends on oven_store. The root keeps oven as a shim re-exporting both under the old paths, so the 53 crate::oven::OvenReceipt, 42 crate::oven::rustc::… and every other crate::oven:: spelling in the driver, CLI and tests/ is untouched. make check-oven-ring builds the three Oven crates in a workspace that contains nothing else.

Two things the plan of attack on #1480 said differently, and why:

• The receipt model went to oven_store, not oven_rustc. Measured: store.rs needs OvenReceipt, OvenBuildIntent and digest_bytes from the root, and the root needs nothing from the baker side. loaves/LAYOUT.md already lists "receipts, identities" under oven_store.
• incan_oven_facet is not a crate yet. IncanProviderHooks reads SdkInventory and discover_active_sdk_inventory from src/provider/, the loaders that become incan_provider in the next step; the facet moves with them.

Facts the split carries, each fixed here:

• A dependency's #[cfg(test)] code is never compiled for a dependent's tests. oven_store::test_support (the frozen fixture project the store tests publish) and the two gates the driver's tests reach in oven_rustc — plan::test_support and OvenRegistryLeafAuthority::new — are #[cfg(any(test, feature = "test_support"))]; process_is_running likewise for the baker tests. The root's dev-dependencies turn both features on.
• Two loaf.rs tests were Incan facts checked against Oven's fixtures — that the complete-stdlib Loaf fixtures cover every checked SDK component module, and that the envelope's inspection surface matches incan_core::lang::stdlib::extra_crate_deps(). They live in the facet's tests now; nothing under loaves/oven names incan_core.
• CARGO_MANIFEST_DIR meant the checkout root in legacy_cargo (the source-compiler vocab support root) and sdk_staging (the runtime crates); both anchor at oven_model::toolchain_layout::development_root() now. The one test that walks crates/incan_stdlib moved to the root with the other two.
• pub(super) items were parent-module-only and never reachable from the root; they are pub(crate) in the new crates rather than pub, and the two module-private types that sat in their signatures follow them to pub(crate). Everything that was pub(crate) is pub, as in the earlier steps.
• The Loaf fixtures moved with loaf.rs to loaves/oven/oven_rustc/src/fixtures/; the Makefile release canary, the CI cache keys, oven_evidence.yml, the two release packaging scripts and the installer test that names the evidence workflow follow the path.
• The stringly-vocab scan in tests/vocab_guardrails.rs walked src and crates only; it walks loaves too now, so the frontend, IR, emission and Oven code did not silently leave it.
• The packaged-provider identity test (…_issue1469) exercised IncanProviderHooks, so it moved from oven.rs's tests to the facet's.

Type of change

• Bug fix
• New feature
• Refactor / maintenance
• Documentation
• CI / tooling
• RFC (adds/updates docs/RFCs/*)

Area(s)

• Incan Language (syntax/semantics)
• Compiler (frontend/backend/codegen)
• Tooling (CLI/formatter/test runner)
• Editor integration (LSP/VS Code extension)
• Runtime / Core crates (stdlib/core/derive)
• Documentation

Key details

• User-facing behavior: none. Receipt identities, store layouts and Loaf manifests are byte-identical; the compiler identity and provider facts Oven records are the same values, delivered as arguments.
• Internals: two new workspace members. oven_store depends on oven_model, serde, sha2/hex, toml, thiserror; oven_rustc on those plus oven_store, rustix, semver, tempfile, tracing. Cargo.lock gains both. The OvenProviderHooks trait and CompilerIdentity are the Oven ring's only two facts about the compiler.
• Risks: the blanket pub is wider than the crates' eventual surface. interop and legacy_cargo stay modules of oven_rustc until their edges into loaf and rustc are cut; lockfile/dependency_resolver (the generic-vs-facet split) and backend/project/{plan,lock_projection} are the next Oven steps.

Testing / verification

• cargo check -p incan in the six feature configurations; cargo clippy --all-targets default and --all-features with -D warnings; rustdoc gate last
• cargo test -p oven_model -p oven_store -p oven_rustc — 556 tests (121 / 77 / 358)
• cargo test --test codegen_snapshot_tests — 266 unchanged
• cargo test --test cli_layering_guardrails --test vocab_guardrails --test layering_guard
• root unit tests with the CLI built for oven, oven_facet, driver::build, driver::tests, cli::commands::oven
• make check-oven-ring — three crates
• cargo test --test oven_pr_regressions
• one exact Oven root: make test-one TEST_ROOT=tests/cli_surface_tests.rs TEST_EXACT=a_cargo_manifest_beside_a_loaf_manifest_warns_without_stopping_the_build — bake + build

Docs impact

• No docs changes needed (crate READMEs lose their "skeleton" line and say what actually moved; the ring documentation is step 6)
• Docs updated
• Docs follow Divio intent (tutorial/how-to/reference/explanation) where applicable

Checklist

• I kept public docs user-focused and moved internals to contributing docs when appropriate
• I avoided duplicating canonical install/run instructions in multiple places
• I added/updated tests where it materially reduces regressions

Part of #1480 (slice 5, #1478). Builds on #1576 and #1577: the branch carries their commits, so the diff shows all three steps until they land and merge-commit syncs narrow it to this one.