`load_project` grows a `stdlib: Option<&Path>` param (the documented pure
signature `(fs, project_root, stdlib_root) -> LoadedProject`). When a root
is supplied it is `load_unit`'d FIRST, as an implicit always-present unit
pouring its modules into the same `Ctx.files`/`visited` closure the project
and its deps use — not a manifest dep (no package prefix, never declared
per-app). The visited-set collapses an overlapping dep to one load.

No new discovery/linking code: the injection is just another `load_unit`
call, so the floor refs (`Memory::*`, `Panic`) cross-module-resolve once the
stdlib is in the closure.

Tests:
- `ck_load` MemFs units — stdlib joins the closure; absent without injection;
  loads first (FileId order); collapses against an overlapping dep.
- `ck_load` DiskFs — the real `todo` app + `tests/corpus/stdlib/` injected
  share one closure (app modules + Memory/Panic/Assert/Arena/Error).
- `ck_cktest` end-to-end — a public floor ref resolves CLEAN with injection
  and is the E0301 baseline without (factored a `resolve_entry` pipeline
  helper to keep every fn under the R4 80-LoC cap).

Scope (point and stop): this is the loader MECHANISM. The corpus `trap.md`
ratchet-down (the stdlib's own cross-module E0301s / the `effect Assert`
E0501) awaits the driver routing through the loader closure — `front_end`
still resolves one file at a time through `std::fs`. Documented in the
module-system README so the source of truth does not overclaim.

Lands as global slice #46.

@@ -89,1 +109,3 @@
-    let scope = linked.modules.scope(main_id).expect("Main scope");
+        .module(interner.intern(entry))
+        .expect("entry module id");
+    let scope = linked.modules.scope(id).expect("entry module scope");

@@ -461,1 +462,4 @@
 
+    /// Whether the cursor (known to be on `"`) opens or closes a `"""`
+    /// triple-quote, as opposed to a `"`/`""` string literal.
+    fn at_triple_quote(&self) -> bool {