Mechanically enforce the uncatchable-fault boundary convention

Summary

Add a mechanical check script (scripts/check-uncatchable-boundaries.ts or similar, wired like the existing check-* gates) that enforces the uncatchable-fault boundary convention: every generic on E: Exception arm that converts a Pascal exception into a guest-observable value must first re-raise the uncatchable union.

Why

The convention exists in prose (the Goccia.MemoryLimit.pas contract comment, Goccia.UncatchableFault.pas's header, ADR 0109) and is enforced only by review. History says prose is not enough: the stack #1159 review found five already-hardened-adjacent boundaries that still converted or swallowed uncatchable faults (Response.json's audit arm, Array.fromAsync's inner close arm, the RegExp compiler arms, the iterator-close helpers — twice, first missing the integrity family, then the limit family), and the allowlist had drifted into four hand-spelled variants within a single round. The repo's own precedent is to mechanize such conventions rather than trust review (scripts/check-conformance-claims.ts, commit 507529cd's "enforce the no-hand-typed-test262-number rule mechanically").

Current behavior

~150 generic on E: Exception do arms exist under source/. The hardened ones carry either explicit re-raise arms, IsEngineIntegrityFault, or IsUncatchableFault; nothing detects a NEW conversion boundary added without a guard, and nothing prevents a fifth hand-spelled variant of the family.

Expected behavior

• A script classifies each generic arm: guarded (names IsUncatchableFault/IsEngineIntegrityFault or an explicit re-raise allowlist), exempt (annotated with a structured comment stating why — e.g. host-side-only code that constructs no guest value, or an allowlist-converter that re-raises unrecognised classes), or violating. Violations fail the check with file:line.
• An explicit exempt-list or in-source annotation keeps the check honest about the known residual boundaries (TGocciaApplication.Run until #1167 lands; the fetch worker thread; snapshot Finish) rather than silently skipping them.
• Wired into the same pre-push/CI path as the sibling check-* scripts.

Scope notes

• Static text analysis is acceptable (the sibling checks are text-based); a full Pascal parse is a non-goal. False-positive pressure is handled by the annotation mechanism, not by weakening the rule.
• Non-goal: changing any boundary's behavior — this issue only detects; #1167 and future hardening change behavior.
• Related: ADR 0109, Goccia.UncatchableFault.pas ("an allowlist spelled out by hand is one that can be spelled out incompletely"), stack #1159 review history.

Start by reading scripts/check-conformance-claims.ts and the existing check-* gates, then inspect generic on E: Exception arms under source/. Define how guarded, exempt, and violating arms are reported with file:line, using the issue's named annotations and allowlist cases. Wire the check into the existing pre-push/CI path and verify known residual boundaries remain explicit.