[M1-ECS-04] Query API + iteration legality

[offdev]

M1-ECS-04 · Query API + iteration legality

Implements roadmap/M1-heartbeat.md M1-ECS-04 (scope only — no
deterministic-iteration contract, no systems):

• World::each<T1, T2, ...>(fn, Read/Write tags...) over the
  M1-ECS-03 SoA rows: superset match (extra components do not exclude
  an entity); per-component access declared by tag type (Read →
  const T&, Write → T&, decided at compile time; count/type
  checked by static_assert). The access tags follow the callable — a
  pack of parameters must be last to be deducible, so the PRD sketch
  order (access_flags, fn) is settled here as (fn, tags...) and
  documented in query.h. each<>(fn) visits all live entities in
  ascending slot order; an unregistered listed type matches nothing
  (ok Status, zero visits).
• Iteration legality (FR-12.3): a stack-scoped guard (two
  membership-only 256-bit sets: the matched-archetype set, complete
  before the first callback, plus the Read-declared component set).
  Illegal — an in-place write of a Read-declared queried component, a
  structural add/remove/destroy/clear touching a matched source or
  target archetype, or a nested each() — asserts in debug and in
  release returns ErrorCode::InvalidArgument (no new codes — the
  registry stays additive-only) + one rate-limited warn + skip,
  never applied, while the iteration continues over the unmutated
  storage. Legal: create() always, structural moves outside the
  matched set, writes through Write references, in-place overwrites
  of Write-declared components.
• No hidden allocations: iteration state is stack-scoped
  (ids[N]/cols[N]/matchedIds[256]/two 256-bit sets); the
  10k-entity × 2-pass window measured zero process-wide heap
  allocations (test-only operator new counter, non-sanitizer
  trees; sanitizer trees leak-free) and zero reservation delta
  (pool-steady), ≈0.044 µs/visit on the -O0 tree — machine-greppable
  query-iteration <stats> lines per ctest run (CORE-001,
  M1-BENCH-01 baseline input).
• clear() is now Status (the guard check runs first — a clear
  under a live iteration is rejected whole, never partial; the dtor
  never sees an active iteration); all call sites honor
  [[nodiscard]] (internal M1 API change, pre-gate, no external
  consumers).

Tests — new query CTest entry (ctest -R query), 17 cases:
exact mixed sets (incl. the superset case), empty-query slot order +
a legal concurrent destroy, unregistered no-match, access-tag
reference kinds, pinned archetype-then-slot visit order, guard release
after iteration, the legal-mutation matrix, the release skip matrix
(state unchanged, iteration continues over both entities, the same op
succeeds afterwards), six forked SIGABRT debug-assert children
(one per violation kind), warn-once + rate_limited summary via a
memory sink, and the zero-alloc window.

Docs: new docs/api/query.md (contract + Performance section),
cross-refs in entity.md / archetype.md / component_registry.md /
docs index / sim README; laige-api.json regenerated (451 symbols);
roadmap checkbox, Progress Board 4/25, one-line Change Log.

Verify: canonical g++ tree zero-warning, full ctest 37/37,
ctest -R query green (debug: 15 passed + 2 release-only skips;
release: 11 passed + 6 debug-only skips); sim suites green on
build-asan (ASan+UBSan, leak-free), build-clang, build-release,
build-shared, build-tsan; tools/laige-include-lint OK.