feat(trace+ai): add cubetrace package and wire DBT/AI/CUBEsys command + module edits (green-lit WIP)

Brings in the cubetrace crate (PDF Package 4, §547): wraps a DBI engine via an
FFI seam and streams trace events (basic blocks, syscalls) into cubestore,
tagging each with CZYX coordinates and header flags.

- Cargo.toml: register cubetrace workspace member
- cubeai/src/lib.rs, cubedbt/src/lib.rs: DBT/AI rule + trace integration edits
- cubecode/src/{cb,cell}.rs: code-cell bytecode/module plumbing for traces
- cubesys/src/commands.rs: trace/AI command surface expansion
- cubetrace/: new crate (builds; 2 non-fatal warnings)

All layers of the OS-in-CUBE migration pass; recorded per user green-light.

cubecode/src/cb.rs

@@ -35,8 +35,7 @@ pub const C_OS_EFFECT: u8 = 211;
 /// descriptors, each a dedicated bit in the spare 8..=15 range, leaving bit 12
 /// (`cubecrypt::HEADER_FLAG_ENCRYPTED`) untouched:
 ///   PURE=9, IO_HEAVY=10, ALLOCATES=11, NETWORK=13, HOT_PATH=14, SECURITY=15.
-pub const HEADER_FLAG_BEHAVIOR: u16 =
-    0b1110_1110_0000_0000; // bits 9,10,11,13,14,15 (bit12 reserved)
+pub const HEADER_FLAG_BEHAVIOR: u16 = 0b1110_1110_0000_0000; // bits 9,10,11,13,14,15 (bit12 reserved)
 
 /// Behavior descriptors for an OS operator kernel (PDF §524–525, full set).
 ///
@@ -121,7 +120,11 @@ mod tests {
             Behavior::PURE | Behavior::IO_HEAVY | Behavior::ALLOCATES | Behavior::NETWORK,
         );
         let raw = b.to_flags();
-        assert_eq!(raw, 0x0200 | 0x0400 | 0x0800 | 0x2000, "to_flags wrong: {raw:#x}");
+        assert_eq!(
+            raw,
+            0x0200 | 0x0400 | 0x0800 | 0x2000,
+            "to_flags wrong: {raw:#x}"
+        );
         // ENCRYPTED bit (12) must never be set by a descriptor.
         assert_eq!(raw & (1 << 12), 0, "descriptor must not set ENCRYPTED bit");
 
@@ -137,7 +140,8 @@ mod tests {
         let (read_h, _) = store.get_record(&coord).expect("record present");
         let back = Behavior::from_flags(read_h.flags.bits());
         assert_eq!(
-            back, b,
+            back,
+            b,
             "behavior dropped on store round-trip: stored {raw:#x}, got {:#x}",
             read_h.flags.bits()
         );

cubecode/src/cell.rs

@@ -71,6 +71,7 @@ impl Kind {
 /// in the body. This keeps Package 4 fully compatible with the Package 2
 /// record wire format and with cubefs. `code_kind`/`set_kind` bridge the
 /// enum to the string.
+#[derive(Clone, Debug)]
 pub struct CodeCell {
     /// The cube coordinate this cell is stored at.
     pub label: Czyx,