runtime: put el_runtime.c on a ratchet, and actually run the guards

scripts/check-single-runtime.sh guards against el_runtime.c being COPIED — it
was written after a lagging fork shipped to prod and dropped learned hebb edges.
Nothing guarded against it GROWING. So it grew: 10,607 -> 20,527 lines, 94% in
3.5 months, the whole time under an explicit commit-message promise that it was
a temporary shim about to be deleted.

Worse, the copy guard was never wired in. Its own footer described the CI
wire-in as a TODO, and the TODO had never been done — the script existed but ran
nowhere, in no workflow and in no hook, so it had caught nothing for as long as
it has been in the tree. A guard that does not run is a comment.

This adds the missing guard and runs both.

  * lang/runtime/BUDGET — a RATCHET, not a limit. max_lines is set at the
    current 20,527 with NO headroom: the file cannot grow by one line. A second
    cap, max_engram_fns (279), counts top-level engram_/eg_/cog_ definitions in
    it — ~47.5% of the file is engram code and engram already owns six sibling
    .c files, so this is the scoreboard for moving it out. Both may only go DOWN.

  * scripts/check-runtime-growth.sh — enforces the ratchet, and three
    invariants that keep the multi-file runtime honest: every .c in
    lang/runtime/ is either in SOURCES or explicitly platform-optional (an
    unaccounted .c is compiled by nothing and is silently dead); install.sh's
    hardcoded download list matches SOURCES (it cannot call the helper — it
    runs where there is no checkout — so that copy is checked, not trusted);
    and an advisory nudge to lower the budget when you have earned it.

  * Both guards now run as early steps in ci-dev.yaml, ci-stage.yaml and
    sdk-release.yaml, and in .githooks/pre-commit.

The failure message is the point. The guard that existed said what was wrong but
not where the code should go, which makes it easy to "fix" by arguing with the
guard. This one names the destination: the concern-owning .c, or a new .c plus
one line in SOURCES, or c_source in a program's manifest.el — and it prints the
`nm` command that proves placement is link-time and that the shipped compiler
already links from ten translation units. Every runtime file except el_runtime.c
is deliberately uncapped, because that is where code is supposed to go.

Proven with negative controls, per lang/AGENTS.md step 5 — each shown FAILING:
  * +1 line to el_runtime.c                  -> FAIL (20528/20527)
  * +1 engram fn, net-zero lines             -> FAIL (280/279)
  * a new unaccounted lang/runtime/*.c       -> FAIL
  * engram_store.c removed from install.sh   -> FAIL, names the missing file
  * el_runtime.c truncated to 20,000 lines   -> PASS + "lower max_lines to 20000"
  * baseline, tree unmodified                -> OK, and both guards green

el_runtime.c is byte-identical after the controls; this commit changes zero
lines of it.

scripts/check-single-runtime.sh

@@ -81,14 +81,14 @@ fi
 echo "OK: single canonical runtime source — $CANONICAL (no un-allowlisted forks)."
 
 # ---------------------------------------------------------------------------
-# CI wire-in:
-#   foundation/el .gitea/workflows/ci-dev.yaml, ci-stage.yaml, sdk-release.yaml
-#   Add an early step (before the build/publish steps). It must run from the
-#   REPO ROOT, so override the job's `defaults.run.working-directory: lang`:
+# CI wire-in — DONE (2026-08-16). This block used to describe the wire-in as a
+# TODO, and it had never been done: the guard existed but ran nowhere, so it
+# caught nothing for as long as it has been in the tree. It is now an early step
+# in ci-dev.yaml, ci-stage.yaml and sdk-release.yaml (each with
+# `working-directory: ${{ github.workspace }}`, since the jobs default to lang/),
+# and it runs in .githooks/pre-commit.
 #
-#     - name: Guard - single canonical runtime source
-#       working-directory: ${{ github.workspace }}
-#       run: bash scripts/check-single-runtime.sh
-#
-#   Also add to .githooks/pre-commit so drift is caught before it is committed.
+# Its sibling scripts/check-runtime-growth.sh is wired in at the same points and
+# guards the other half of the problem: this script stops el_runtime.c being
+# COPIED, that one stops it GROWING.
 # ---------------------------------------------------------------------------