ww: test sources are *_test.ww only (Go contract)

Go compiles only _test.go files as tests; discovery now keys on the
_test.ww suffix alone. The line-leading-@test compatibility allowance
(noncanonical filenames admitted as test sources) is removed from both
driver stages and the coordinator. An @test declaration outside a
*_test.ww file is rejected loudly ("@test declaration outside
*_test.ww", wording byte-identical cs/ww) instead of silently running
under compose or silently dropping in a non-T build (#6). Tree audit
found zero real carriers; the two allowance fixtures flip canonical
(dep_test.ww, widget_test.ww). New pins: direnum attest-noncanon
reject row (both-stage stderr parity) and the coordinator
noncanonical_attest_rejected package row.

test/package/dependency/dep/dep_test.ww

@@ -0,0 +1,7 @@
+package dep;
+
+// Go's contract: a package's *_test.ww sources are not part of the
+// imported package.  Must be excluded when dep is imported by root.
+@test fn imported_dependency_test_must_not_leak() void = {
+	assert(false);
+};

test/package/dependency/dep/deptest.ww

@@ -1,7 +0,0 @@
-package dep;
-
-// Noncanonical migration spelling: the actual line-leading @test makes this
-// test-only.  It must be excluded when dep is imported by the root package.
-@test fn imported_dependency_test_must_not_leak() void = {
-	assert(false);
-};