[1.0] Improve Script host-call diagnostics

[jeremi]

Context

PR #355 establishes the concise Registry Stack project-authoring contract. The core workflow is complete, but a misspelled built-in Script host call, for example source.gett(...) when source.get(...) exists, currently surfaces as a generic execution error followed by many derivative fixture mismatches.

This bounded usability improvement remains useful before 1.0. The previously proposed source-free Notary starter is removed from this issue by the 2026-07-17 credential trust-boundary decision in #384.

The change must preserve the deliberately small declarative model. It must not revive the removed flow DSL or make source capability availability depend on a product or version label.

Scope

• Detect an unknown built-in Script host call at preflight or the earliest safe execution stage.
• For a close misspelling, report the closest accepted signature plus the script path and location when Rhai provides it.
• Keep the diagnostic bounded and value-free. Never echo subject data, credentials, request bodies, source responses, or internal engine state.
• Avoid or collapse downstream fixture assertion failures that are solely consequences of the same unknown host call.
• Add focused tests for typo suggestions, truly unknown calls, diagnostic redaction, and the single-primary-diagnostic path.

Acceptance criteria

• A single near-miss host call produces one primary actionable diagnostic with the closest accepted signature, rather than a screenful of unrelated fixture-result failures.
• The diagnostic identifies the authored script and provides a line and column when available.
• A truly unknown call remains bounded and does not expose values or internal engine details.
• Product or version metadata does not select Script availability.
• No compatibility aliases or operation-oriented flow authoring return.
• The implementation composes with the independent-diagnostic aggregation in [1.0] Aggregate independent Registry project authoring diagnostics #383 without duplicating or cascading the same root cause.

Non-blocking polish

The existing reference-footer and human-scaled byte-limit presentation ideas remain optional polish. They must not enlarge or delay the blocker acceptance above.

Related work

• refactor: make Registry project authoring the single friendly config surface #311
• refactor: derive Relay, Notary, and manifest artifacts from one Registry project model #312
• Converge Relay and Notary on Registry Stack project authoring #355
• [1.0] Aggregate independent Registry project authoring diagnostics #383
• Remove self-attested credential issuance from the 1.0 product surface #384

[jeremi]

Final project-authoring usability review identified two additional non-blocking polish items that fit this follow-up: show the Rhai/xw reference footer only when a project has a script integration, and render byte limits in human-scaled units while preserving exact machine-readable byte counts. Neither affects the pre-1.0 contract or blocks PR #355.

[jeremi]

Implementer-experience clarification after #373: the Notary-only starter should generate the smallest PostgreSQL-backed topology with no Redis dependency and no storage-backend selector. Keep the explicitly non-blocking polish items separate from 1.0 blocker acceptance.