Comptime versus CLI

Noir comptime attributes can generate items inside their own crate but cannot create other packages. The split is therefore:

• Noir comptime (#[weld::params], #[weld::state], #[weld::policy]): params flattening and commitment, state accessors and salt handling, phase marker types, and extraction of assert ids.
• Rust CLI (weld build): emits the three bin packages' main.nr and Nargo.toml from the manifest and the protocol's context schema, then compiles and hashes.

Nothing security-relevant lives in the generated text that is not also enforced by library types; the generated main is a thin call sequence.