fix: harden storage layout canonicalization

[banteg]

Summary

• classify legacy flat layouts and modern nested module layouts through one fail-closed canonicalization path
• validate persistent, transient, and code-layout wrappers; reject unknown fields, malformed leaves, duplicate names, invalid slots, overflow, and overlapping spans
• infer and verify n_slots only where canonical Vyper type grammar proves the width, while keeping unprovable user-defined widths conservative
• preserve compiler-owned interface provenance and full non-interface paths so struct/interface names and unrelated modules cannot alias by spelling
• normalize legacy flag spellings and allow an omitted interface marker only when the target compiler AST proves the exact storage variable, interface name, and recursive type path
• keep target AST optional evidence: unsupported AST output falls back without dropping required ABI, method-identifier, or layout artifacts
• compare transient storage explicitly and recognize only exact, counterpart-backed nonreentrant lock moves or generated compatibility gaps
• retain qualified nested names and normalize only compiler representation differences covered by real cross-version tests

Validation

• full Ruff check — passed
• full test suite — 731 passed
• exact composed-type corpus regressions — 5 passed-to-passed with ABI, method IDs, and storage equal
• selected ChainSecurity layout regressions — 13 passed-to-passed, 13 validation passed, zero ABI/method/storage changes
• full deduplicated corpus — 1,150 rows, zero compile/ABI/method regressions, zero unavailable-layout regressions, and zero exceptions
• full ChainSecurity corpus — 5,291 rows with zero source/target compile, ABI, method-ID, or exception regressions; exact replacement of the 178 affected rows projects 3,014 validation passes and 2,277 conservative blocks
• exhaustive interface/flag slice — 178/178 source and target compiles passed, zero ABI or method-ID changes, 59 AST-proven/flag-normalized passes, and 119 fail-closed storage blocks
• scripts/smoke-wheel.sh — passed

The stable full-corpus comparison leaves 511 pass-to-block transitions: 510 legacy layouts lack provable slot-width evidence, and one nested dependency lacks exact target AST provenance. These are conservative validation results, not guessed equivalences. Imported attributes, nested module layouts, same-named one-slot structs, and IERC*/ERC* aliases remain distinct.