Implement the metadata-only target-reference and F# signature importer

Parent: #8
Blocked by: #25 and #26

Outcome

Build the NativeAOT-safe target-reference universe used by name resolution and typing.

Acceptance criteria

• Public metadata APIs import assembly and module identity, nesting, type forwarders, types, members, accessibility, attributes, generics, constraints, and signatures.
• Independently authored decoding imports the F# semantic signature data required for cross-assembly F# consumption.
• The importer never loads or executes target assemblies and does not depend on runtime reflection types, the official compiler, or FSharp.Compiler.Service.
• Results depend on supplied reference content and options rather than the compiler host target framework; same-path content changes invalidate correctly.
• Malformed, missing, duplicate, or incompatible metadata fails safely with structured diagnostics.
• The production importer remains separate from #17's test-only metadata envelope inspector.
• Strict trimming and NativeAOT publication remain warning-free.

Decision inputs

Issues #4, #5, and #17; ADRs 0002, 0009, 0010, and 0023.

This issue inherits the corpus-neutral acceptance policy in #8.

Start by reading parent issue #8, blockers #25 and #26, decision inputs #4, #5, and #17, and ADRs 0002, 0009, 0010, and 0023. Done means a NativeAOT-safe, metadata-only importer meets all listed acceptance criteria, including F# signature decoding, safe diagnostics, content-based invalidation, separation from #17, and warning-free trimming and publication.