Static whole-image checking for multi-module guest programs.

run/2 is host-side tooling, not a guest surface. The image is a map of absolute virtual paths to source binaries, or a host directory that is read with File. Every command and library in the image goes through the standard compile pipeline under the image's own code-path resolution.

Findings are maps with :file, :line, :kind and :message. The kinds are:

• :invalid_image: the image is not a path map or an existing directory.
• :read_error, :wrong_module, :compile_error: the standard pipeline rejected a source. Compile errors carry the line and span when the compiler attached one.
• :capability_not_granted: a library's derived capability set exceeds the image manifest. The module loader applies the same gate.
• :unresolved_module: a code-path call names a module with no file in any code-path directory of the image.
• :undefined_function: a code-path call targets an existing library at a function and arity it does not export.
• :docs_missing: an enabled sticky stdlib module whose OTP docs chunk cannot be produced host-side. Libraries are covered by construction, because every verified artifact carries a docs chunk.

Module support is forced on for the pass. Checking an image under a modules-disabled manifest would reject every code-path call as undeclared.