tools: let a policy license a vague-linkage duplicate against the cartridge

[andrewboudreau]

Splits the tool half out of #1878 so it can actually be validated. #1878 bundles this
rombuild/objisolate change with the daObjPathLift_c manifest rows that use it, and
the PR validator restores all of tools/ from the base commit — so it runs main's
rombuild.py, which only knows deadstrip, against the new manifest and fails:

src/actors/daObjPathLift_c.cpp: _ZN7Vector3D1Ev disposition must be deadstrip

That PR can never go green on its own. This one carries no manifest change, so it can.

The problem this unblocks

include/types.h declares ~Vector3() {} inline in-class — deliberately; the ROM's
__destroy_arr over arrays of Vector3 proves the element type has a destructor.
Consequence: every TU that so much as holds a Vector3 local emits a vague-linkage
_ZN7Vector3D1Ev (4 bytes, bx lr, STB_LOPROC).

It has a real ROM home at arm9:0x020072c0, owned by src/_ZN7Vector3D1Ev.cpp. The old
policy therefore refused it — compiler_only_output rejects any symbol with a configured
home (correctly: it is not compiler-only), and externalized_output takes only
_ZTI/_ZTS data. Four reconstructed TUs stopped at TEXT-VERIFIED on those four bytes
(ArrowSignRight, daObjPathLift_c, arm9/Actor, ov002/LevelObjects all say so in
their manifest notes). In production it surfaces as:

isolate: unlicensed content in text-only multi-symbol object:
section[21] .text size 0x4 defines ['_ZN7Vector3D1Ev']

What changes

A second disposition whose precondition is the opposite of deadstrip's:

{"symbol": "_ZN7Vector3D1Ev", "disposition": "deadstrip-duplicate",
 "reason": "vague-linkage duplicate; arm9:0x020072c0 owns the retail copy"}

• deadstrip still means homeless-only — refused the moment a symbol acquires a ROM
  home. Unchanged.
• deadstrip-duplicate requires a ROM home and requires it to be unambiguous (exactly
  one configured home, or the row is refused rather than guessed at). rombuild reads the
  module image at that address, sizes it from the same symbols.txt the delink reads, and
  hands the cartridge's own bytes to objisolate, which refuses unless this object's copy
  is STB_LOPROC and byte-identical.

Dropping a duplicate cannot lose the address: the owning source still supplies it, and if
it did not, the link fails on an undefined symbol rather than quietly leaving a hole. That
loudness is the rest of the safety argument. deadstrip_plan already refused when a
surviving section referenced the symbol; that check is untouched.

Also fixed here, because it is the same code path: compiler_only_policies keyed the
policy on source, but a promoted entry is enrolled under promoted_source. This is
forward-looking rather than a live bug -- of the 21 manifest entries carrying a
compiler_only_output today, exactly one (ActorBase_SceneNode) is enrolled, and its
source and promoted_source are the same path, so the old keying happened to work. The
other 20 are unenrolled src_tu/ shadows that the active filter drops either way. The
fix matters the moment a TU is promoted while its manifest still names the src_tu path
-- the shape of every entry in the rest of this chain -- where the policy would otherwise
be filtered out and the build would refuse the very object it was written for.

Test plan

• python -m pytest tools/test_rombuild.py tools/test_objisolate.py -q → 52 passed,
  including five new cases: the cartridge-body demand, the required ROM home, the
  ambiguous-home refusal, the unknown-disposition refusal, and the promoted-path keying.
• python tools/rombuild.py -j 16 → 106/106 exact, 100.000000% of compared bytes; 11,082 source-built functions, 11,082 reproducing, 0 mismatching -- byte-identical to main, as expected for a change that only widens what a manifest row may declare.
• python tools/port_refcheck.py → 405 checked, all references resolve
• python tools/prepush_attribution.py --base origin/main --head HEAD → 11,388 tracked, 0 changed, 0 lost

No src/, config/ or include/ file changes, so no byte can move: this PR only widens
what a future manifest row is allowed to declare.

Follow-up: the daObjPathLift_c promotion half of #1878 rebases onto this and becomes a
config+src-only PR the validator can judge on its merits. #1880 → #1882 → #1884 → #1914
then restack behind it.

[tangos-validator]

✅ PR validation — Passed

noverify: no source/build-data changes in this PR

_{Each changed src/*.c|*.cpp is compiled and its relocated bytes compared to the binary data on a private build box. Passing requires every changed file to reproduce the ROM byte-for-byte with correct relocation targets — this catches WRONG-DEST relocations and non-reproducing near-misses that ledger-scoped linkcheck skips.}