name and enforce the operand-headed statement shape

[Redict]

Stacked on #2240, which adds (comesfrom ^SYM S*). Draft until that merges; the diff here includes its commits.

Two statement tags are transparent wrappers, no scope and no semantics, but their first child is an operand:

(pragmax ^(pragmas ...) X)   the pragma list
(comesfrom ^SYM S*)          the expanded symbol

A pass that doesn't care about the tag should just descend into the body, which makes these look like (stmts ...). They aren't. A generic child walker walks the operand, silently, and the damage surfaces several passes later.

pragmax has 9 hand-written branches today. comesfrom needed 16 more in #2240, four of them found by breakage rather than reading: derefs/vl surfaced as an init error in widestrs.nim, cse hoisted a load above a declaration the expansion makes, lengcgen emitted a global's initializer as a C constructor running before NimMain. Each in a different suite. Plus 4 in arkham (nim-lang/nativenif#95), caught by CI.

Nothing recorded the property. doc/tags.md had pragmax backwards, (pragmax X (pragmas ...)), when every producer, all 7 consumers and all 68 .nif fixtures put pragmas first. So the 9 branches read as folklore, not a pattern.

What's here

OperandHeadedS = {PragmaxS, ComesfromS} in nimony_model, mirrored as {ComesfromS} in leng_model. Transparency is the criterion, not the leading operand: (block .D X) has the same shape and is excluded, being a scope and a break target.

bodyInto is an into-shaped template that steps over the operand, so the right walk is shorter than the wrong one:

n.into:                    n.bodyInto:
  skip n # origin symbol     while n.hasMore:
  while n.hasMore:             trStmt c, n
    trStmt c, n

Row 143 corrected in place, since gen_tags.nim derives tag values from the row index. No ordinal moved.

A ^ slot modifier marks the operand, alongside the existing .D, T?, S*. The validator reads it and reports a case n.stmtKind branch that opens such a tag and walks every child.

Why new table syntax

Keying on slot kind doesn't work. (bind Y) and (mixin Y) lead with the same kind as (comesfrom ^SYM S*); (when ...), (using ...), (if ...) match (pragmax ^(pragmas ...) X). None is transparent. 11 of 15 validator pass files failed that way. (instr SYM X*) is the sharpest case: same shape as comesfrom, not transparent, correctly excluded only because it's unmarked.

Reading a marker sentence from the row prose worked but is fragile the same way the original bug was. Reword the row, the check stops firing.

A 5th column isn't possible, gen_tags.nim requires exactly 5 fields. Per-slot modifiers are already how this table says things about slots. Adding ^ also meant documenting the slot notation, which was written down nowhere.

Scope and honest limits

The 25 existing sites are left alone. One was converted, controlflow.nim, as a smoke test.

The check would not have caught any of the four regressions. All four were permissive else: branches with no branch for the tag at all, which the existing exhaustive-case check already reports. This covers the follow-on shape: an author who writes the branch that check forces, then walks every child.

It fires on 8 branches in existing pass files, including eraiser.nim, whose branch is commented "generic container: copy the head and recurse into the children". Whether each is a live bug depends on what the pass does with what it walks, and the check can't tell a copy from a rewrite. So it warns instead of erroring: pass files stay green, sites get reported, nobody's forced to rewrite working code.

Testing

655/655 on the base branch, 656/656 with this, validator 16/16. The golden tests/check_tags/fake_operand_headed.nim covers the violating form, both conforming forms, and the dispatching form that must stay quiet. Deleting the check drops it to 15/16.

Removing ^ from the comesfrom row drops detection to zero; restoring brings it back.

Full rationale and the alternatives weighed are in openspec/changes/add-operand-headed-stmt-set/.