rules/iostream: restore the missing t1 refcount target -- a latent tree-wide load failure

`src.cpp` declares `using t1 = std::ostream;` and `tgt_unsafe.rs` has a `t1`, but
`tgt_refcount.rs` did not. That is the `using tN` with no matching tN target case, which
aborts at LOAD TIME (translation_rule.cpp:233, `ir_src.json type entry has no matching IR
target rule`) and under NDEBUG presents as rc=139 with no message. check-ir.sh reported
`LOAD FAILURE (refcount model) -- this tree poisons EVERY translation`.

It was LATENT, not new. rules/iostream had not been regenerated into a published tree since
Cpp2Rust#164 made Rust type rules standalone functions, so nothing had ever exercised it; it surfaced
only when the module was regenerated for 0edd622's ios_base::in/out keys. The same class of
latent asymmetry was hit twice in one hour, which is why this commit spells the rule out in the
file: A MODULE THAT HAS A tgt_refcount.rs MUST CARRY EVERY KEY IN IT, even where the body is
byte-identical. The "a value-like key needs no refcount override" guidance is about the
ir_refcount.json OVERLAY, and it does not license omitting a TYPE key from the target file.

Body mirrors tgt_unsafe.rs's t1 verbatim, because a plain owned value is model-independent --
no Ptr, no raw pointer, nothing to re-shape. Deliberately NOT "improved": `File::open("")`
always fails so that initializer would panic if it were ever materialised, which deserves its
own look, but changing committed unsafe behaviour while fixing a load failure would conflate
two things.

Also recorded here because it cost two slots and is still open: refreshing pin/ir.v9 to HEAD
exposed a SECOND, unrelated latent load failure, in rules/shared_ptr f1 --
`LLVM ERROR: Expr rule uses init but its src pack is not declared as Init<T, Args>`. That one
is NOT fixed by this commit. f1 records as the bare `std::shared_ptr<T1> std::make_shared()`
with the `Init<T1, Args>` pack LOST while both its targets emit `{"init": null}`; every working
init user (unique_ptr f8, vector f112-114, vector_cxx11 f1-3, deque f12-13, deque_cxx11 f1-2)
records an `init_type` pack and a `(&&...)` key. Removing the unused leading `typename T2` from
f1 -- making it match unique_ptr f8 exactly -- did NOT change the recorded key, so that
hypothesis is dead. pin/ir.v9 is green only because it deliberately retains the OLD pre-break
shared_ptr IR, which is recorded in its provenance file; regenerating shared_ptr into it would
re-poison every agent's baseline via newir.sh. The same error independently blocks all
structured-binding measurement (`auto t = std::tie(x, y)` aborts identically), so it now gates
the top measured row as well.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Agent User

rules/iostream/tgt_refcount.rs

@@ -5,6 +5,27 @@ use libcc2rs::*;
 use std::os::fd::AsFd;
 
 // TODO: t2 and t3 should be translated to Ptr<dyn Traits>
+// t1 -- `std::ostream` by VALUE (t2 is `std::ostream &`, t3 is `std::ostream *`).
+//
+// THIS WAS MISSING, AND ITS ABSENCE POISONED EVERY REFCOUNT TRANSLATION. src.cpp declares
+// `using t1 = std::ostream;` and tgt_unsafe.rs has a `t1`, but this file did not -- the
+// `using tN =` with no matching tN target case, which aborts at LOAD TIME
+// (translation_rule.cpp:233, `ir_src.json type entry has no matching IR target rule`) and
+// under NDEBUG presents as rc=139 with no message. `check-ir.sh` reported
+// `LOAD FAILURE (refcount model) -- this tree poisons EVERY translation`.
+// It was LATENT rather than new: rules/iostream had not been regenerated since #164 made
+// Rust type rules standalone functions, so no published tree had ever exercised it, and it
+// only surfaced when this module was regenerated for the ios_base::in/out keys.
+//
+// The body mirrors tgt_unsafe.rs's t1 verbatim because a plain owned value is
+// model-independent -- no Ptr, no raw pointer, nothing to re-shape. Deliberately NOT
+// "improved": `File::open("")` always fails so this initializer would panic if it were ever
+// materialised, which is worth a separate look, but changing committed unsafe behaviour while
+// fixing a load failure would conflate two things.
+fn t1() -> std::fs::File {
+    std::fs::File::open("").unwrap()
+}
+
 fn t2() -> Ptr<std::fs::File> {
     Ptr::null()
 }
@@ -28,3 +49,25 @@ fn f3() -> Ptr<::std::fs::File> {
 fn f4() -> Ptr<::std::fs::File> {
     libcc2rs::cerr()
 }
+
+// f5/f6 -- std::ios_base::in / ::out. Bodies identical to tgt_unsafe.rs: these are plain
+// `unsigned int` constants (libcxx/ios:283-288, `typedef unsigned int openmode; in = 0x08;
+// out = 0x10`), so nothing here is model-dependent.
+//
+// THEY ARE RESTATED ANYWAY, AND THAT IS NOT OPTIONAL. 0edd6227 added them to src.cpp and
+// tgt_unsafe.rs only, on the reasoning that a value-like key needs no refcount override
+// because ir_unsafe.json is the unconditional base layer. That reasoning is right about the
+// OVERLAY and wrong about THIS module: because rules/iostream HAS a tgt_refcount.rs, omitting
+// a key from it leaves ir_refcount.json with 6 keys against ir_src.json's 9, and the
+// converter then ABORTS AT LOAD TIME in the refcount model -- `check-ir.sh` reported
+// `LOAD FAILURE (refcount model) -- this tree poisons EVERY translation` with a core dump.
+// So the rule is: a module that has a tgt_refcount.rs must carry EVERY key in it, even where
+// the body is byte-identical. (rules/mlir legitimately runs 151 src / 149 refcount keys, so
+// the omission is tolerated somewhere -- but not here, and check-ir.sh is the authority.)
+fn f5() -> u32 {
+    0x08
+}
+
+fn f6() -> u32 {
+    0x10
+}