feat(op): mem and function are sealed; function stops borrowing another provider's identity - #676

Phase 5 of #625. Closes #662.

The last cross-package resource embed in the tree is gone.

The embed came out cheaply, because of groundwork already laid

function.Resource embedded mem.Resource across a package boundary — the only such embed anywhere — and
it was never composition. function built its own base with reflect.TypeFor[*function.Resource]() and
handed that to the embedded value, so mem was contributing behaviour over function's own identity. A
mixin, wearing an is-a relationship.

The ruling anticipated mem exporting a constructor taking a caller-built base. It did not need one: #668
had already moved the content-address path formula into op, so function now embeds op.ResourceBase
like every other provider and reaches its pack through op.ContentAddressedPath /
op.ContentAddressedReader.

function inherited nine methods and genuinely used two — SourcePath and the Hash field. Pack
and Unpack never delegated; they build their own transport envelope. sourceBytes already opened its own
mmap. The remaining seven are the per-provider set service, git, appnet, json, and yaml each
write for themselves, so supplying them was joining the convention rather than paying a cost.

The first out-of-package consumer

pkg/op/provider/plan/lifecycle_api_test.go calls ConvertTo on a transported function, so
function.Resource declares CanConvertTo / ConvertTo. That is the first sealed interface to reach
past op.Resource plus accessors — every earlier provider's apparent external consumers turned out to be
in-package or doc comments. The plan predicted a phase would eventually have to decide differently; this is
it.

function's six exported fields had no external readers, so they went unexported with no interface
methods at all. The transport envelope keeps its exported fields — that struct is the wire form, and
encoding/json must be able to set them.

Running lint before pushing caught four things

make vet and make test cannot see any of them:

• ConvertTo at cyclomatic complexity 16, over the ceiling of 15 — signature validation lifted into
  bridgeable, which changes no behavior
• three receiver-naming inconsistencies (r where the file uses f)
• three misspellings

The last two PRs shipped without that check and one of them failed CI on dead code. This is the first phase
where the gate ran before the push rather than after.

Verification

make test 103 ok / 0 fail · make build · make vet darwin/linux/windows · test-scenario ·
complexity · shell-lint · verify-ldflags · star lint go ./pkg/... — 0 issues · gofmt -l clean.

Metadata preserved without hand-editing: mem 3 entries, function 4 — #658's generator fix holding on
the last two providers of part 1.

Seven of nine providers sealed. pkg (#644) and file's four variants (#645) remain.