Epic: fourth audit, of the third round's changes

Start with the listed audit findings #321–#330 and reproduce the corresponding cases in a scratch module, as the issue says was done for the earlier findings. Read each linked issue for its scope and expected behavior; the epic itself does not specify implementation files or tests. Done means resolving the selected finding and confirming its behavior with a focused regression check.

A fourth, focused audit of the third round's changes (#302–#319, unreleased). Each finding was reproduced in a scratch module.

P0

• #321 shrink: a nested module can build a different copy of a module whose path is in the judged range. This is the nested-module counterpart of #284

P2

• #322 shrink: a nested module's own go.work is ignored. This is a regression from #319
• #323 analyzer: an external test package inherits its folder's non-Go files. This is a regression from #308

P3

• #324 analyzer: the folder's non-Go check counts files the go command never builds
• #325 survey, inspect: a cgo package that does not compile is named by "could not import C". This is a gap in #312
• #326 baseline: keep shrink's entries of a package shrink left unjudged, and say so. This is a gap in #304
• #327 shrink, survey: name a failed package by one line, everywhere. This is a gap in #312
• #328 release: check-version.sh warns on GNU grep and misreads a two-digit major. This is a gap in #314
• #329 baseline: separate the -merge messages for a file that cannot be read and one that cannot be parsed
• #330 docs: the design notes still name evidenceStructOf

Checked and found sound

• The internal/typeparams port matches x/tools v0.52.0 line by line. Everything dropped is unreachable code or debug code.
• pointer.Sets handles receiver type parameters, instantiated constraints, and a type parameter whose constraint names another type parameter.
• go test -race ./internal/shrink/... passes. The parallel nested loads (#305) give byte-identical output across runs.
• shrink -fix on x/tools v0.52.0 (631 reports, 263 fixes) and x/net v0.61.0 (61 reports, 27 fixes): go vet passes for linux, darwin and windows, and a second run is stable.
• -merge (#304) handles test variants, x_test packages, -o targets and nested-config targets.

The performance comparison of v0.22.0 against main is still running. Its findings will be added here.