.shc contract

Separately checkable public module surface. A companion .shc beside a .shp implementation declares the stable headers (types, values, behaviors) that callers and dependent checking see. Bodies may still be todo; the contract is checked before implementation fill-in.

Use a first-line module: Signature; in .shp instead when the goal is to reuse an existing module type without a separately checkable contract. The two forms are mutually exclusive.

Ship adapts the useful parts of OCaml's .mli workflow: explicit public shape, dependent checking against a compiled shape artifact, and promotion tooling — not duplicated hand-written implementation mirrors.

Every function header chooses both channels explicitly: fn! or exn for the exception axis, and pure fn or eff for the effect axis. #infer let name; is the explicit opt-out that reads the companion implementation.

See ../01-syntax.md (modules / contracts) and ../12-future-tooling.md.