Interprocedural stage 2: per-overload signature keys (sig) in the MOS

[PhysShell]

Roadmap: docs/notes/interprocedural-roadmap.md §5 / docs/notes/interprocedural-tz.md §6.1 — the hard-tier task, taken by the top layer directly.

What

Same-name overloads no longer share one conservative summary. An optional sig (canonical parameter-type list: FQ names, comma-separated, no spaces, generic arity via backtick, global:: stripped) may appear on functions[] records and call ops. When an overloaded name's records carry it:

• _build_skeletons emits one summary per overload keyed name(sig) beside the name-merged fallback;
• every consumer resolves through one helper (_mos_lookup: sig key → exact name → canonical name) — the overload channel, kill sites, OWN051 collection, the fresh-result mint, branch hoisting, and the method's own param seeding — so the untrack set, the advisories and the emitted effects can never disagree;
• the extractor stamps sig from the same resolved IMethodSymbol on both sides of the edge (CanonicalSig; type arguments erased to backtick arity — a collision merely merges, never mis-resolves).

Fallback rule (load-bearing, tz §6.1): a sig missing/unmatched on either side lands on the merged summary — degraded, never a wrong overload. first_party/overloaded suppressions stay keyed on the bare name (INV4). Additive: no OWNIR_VERSION bump.

Recall restored

• sig'd call to the fresh overload of a mixed factory → dropped result is OWN001 (merge lost this);
• sig'd call/forward to a consume overload → OWN002 on use-after-handoff (merge diluted it to may);
• sig'd call to a borrow overload → verified lend, fully silent (no OWN051 noise).

Done

• Spec: spec/OwnIR.md §5.1 + spec/ownir.schema.json; parity dump carries both key vocabularies.
• Tests: tz §6.1 matrix in tests/test_ownir.py (14 new checks, 270/270 green) incl. global::-qualified sig, mixed producers, unmatched-sig fallback, duplicate name+sig, dump byte-determinism. Bonus fix: latent parity-dump nondeterminism (merged param name was input-order-dependent).
• E2E: frontend/roslyn/samples/OverloadSigSample.cs + CI assertions (sig on both edge sides in facts; OWN001 in Drop).
• Tier B review (DoD): Process.Start / new StreamReader(stream) stay excluded — ambiguity is BCL-side (static-vs-instance, adopt-vs-factory), no functions[] records there. A sig-keyed Tier B table is now possible (call ops carry sig) — recorded as an additive follow-up in roadmap §5.

Branch: claude/plans-tasks-review-u77dfs (commit 540e07d). Gates run locally: python tests/run_tests.py, ruff check ., mypy ownlang — all green; the extractor half compiles/runs in CI (wpf-extractor job).