feat(runtime): dynamic object creation and destruction

[devin-ai-integration]

What and why

An object was materialized once, from its declaration, and nothing destroyed it: new T(…) built a message-shaped value for send, an object written into a feature was classified by it but owned by nothing, destroy refused an object whose state machine was under way (ErrOccurrenceLifetime), and a destroyed object stayed in all T. This is the object-model item the roadmap's addressed-send item (E7) waits on: a context must hold more than one object of one usage and be able to destroy one.

Now an object created while a behavior runs is a first-class occurrence of the run:

• evalConstructor → Context.constructObject: materialize, then startClassifierBehaviors, so a new Car(…) has its own identity, begins its life where it is made, is classified by Car and runs the behaviors Car exhibits/performs. Two new Car(…) in one context are two objects; a loop creates one per iteration.
• SetFeatureValue → Context.holdWritten: the holding feature's type classifies the written object (classifyHeld), and a composite feature (not ref) adopts an ownerless object as a portion of the owner (owner/ownerFeature, journaled), so destroy of the whole ends it.
• destroy: ends the occurrence and its portions, then endBehaviorsWith terminates the state machine it exhibits and the actions it performs where they stand; a destroy reached from inside one of them unwinds it as terminate does. The checkMayEnd/performanceUnderWay refusal is gone.
• objectsOf skips destroyed objects, so all T releases them; a feature still naming one keeps the value and reading through it is ErrOccurrenceDestroyed.
• nextRunnableBehavior discards a pending behavior whose object was destroyed before its first run; performanceOccurrence resolves an already-held performance occurrence without dereferencing the destroyed object, so a held image of such a graph materializes.

Spellings are the specifications' only: KerML §7.4.9 new T(args) in any expression position and OccurrenceFunctions::create/addNew/addNewAt. SysML v2 defines no other textual constructor for an occurrence of a definition; the compliance record says so. The addressed send … to <expr> that picks the second object is not part of this change.

Specification basis

KerML 1.0 §7.4.9 (InstantiationExpression/ConstructorExpression), SysML v2 §7.6 (feature values, occurrence usages), Kernel Semantic Library Occurrences.kerml (an occurrence's life; OccurrenceFunctions::create/destroy). docs/project/spec-compliance.md: a new Dynamic object creation row in the Instantiation map, the create/destroy row and the all T row updated to the new semantics, and the "Dynamic object creation/destruction" bullet removed from Major Features Not Implemented. docs/project/roadmap.md records the item as landed and unblocks E7.

How it was verified

• Conformance object_created_by_constructor and object_destroyed_at_runtime, each with a trace golden (create: Car #n per object; destroy: Car #5 followed by the terminated machine, no later run).
• robustness_object_lifecycle_test.go TestRuntimeRobustnessObjectLifecycle: two objects of one usage distinct and held, creation in a loop, destroy through a reference, destroy ends the created object's machine, destroy twice refused, destroy of the whole ends created parts, deterministic explore over creating branches, a destroy/read race reaching exactly two outcomes.
• TestDestroyRefusedWhilePerforming became TestDestroyEndsTheMachinePerformed.
• go build ./..., go vet ./..., gofmt -l . empty, python3 scripts/changelog.py check, python3 scripts/check-doc-ids.py, and go test ./... with OPENSYSML_REQUIRE_TRAINING_CORPUS=1 OPENSYSML_REQUIRE_PILOT_CORPORA=1 OPENSYSML_REQUIRE_PILOT_LIBRARY_XMI=1 all green (the one timing test TestFormattingDiffIsCheaperThanFormatting failed once under the full parallel run and passes with -count=3 alone).
• REPL: after two new Car the fleet lists [Instance(ID: 5), Instance(ID: 7)] in %features and size(all test::Car) counts them.

Checklist

• make test and make lint pass locally
• Tests added or updated for the change
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added as changes/unreleased/<slug>.<section>.md, not as an edit to CHANGELOG.md
• baselines regenerated and make docs-counts run if a gate count moved (compliance rows need nothing: the census is counted at docs build)
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring