Sema accepts length-less [T] binding annotation; produces silently corrupt slice (xs.len() wrong)

[ehartford]

Summary

let xs: [i32] = [1, 2, 3] compiles WITHOUT diagnostic and runs corrupted: xs.len() returns 2 (garbage — the binding is slice-typed but holds array-literal bits, so the fat-pointer header is misread). Affects any element type (found while fixing #586: let opts: [?i32] = [...] asserted len()==3 false after the element-typing fix).

Spec

§4 (line ~1628): the array type is [T; N]; the slice type is []T (§4.8). A bracketed length-less [T] binding annotation is NOT a defined type form. Per §20b (forbid, don't warn) sema should REJECT the annotation with a hint ("did you mean [T; N] or []T?") — silently accepting it manufactures a corrupt view.

Repro (HEAD, post-1da33dac)

fn main:
    let xs: [i32] = [1, 2, 3]
    print_i32(xs.len() as i32)   // prints 2, expected: rejection at check time

Candidate fix

resolve_type_expr's bracketed-type branch: a length-less non-[] bracket type in binding/annotation position is an error. Note stage-1 []mut work added in_param_type_position — the rejection must not affect legal []T/[]mut T params.

[ehartford]

Ruling (WWED, mission-derived): reject with a teaching hint. [T] as inferred-length sugar was considered and declined: [T] vs []T one character apart with different meanings is a footgun, and the annotation is unnecessary anyway — inference already handles let xs = [1,2,3]. Diagnostic shape: "[i32] is not a type — write [i32; 3], []i32, or drop the annotation (it is inferred)". Guardrail restored (§20b forbid-don't-warn), zero ceremony added. Scheduled in the campaign's robustness track.