Codegen and toolchain

One deterministic codegen pass is the source of truth for every generated file; run it first, scope it tightly, and decide once whether its output lives in git. Applies whenever a project uses build_runner or gen-l10n.

Read the reference for the task at hand:

• references/codegen-scoping.md — the generator inventory, generate_for: scoping tables, error-to-fix recovery map.
• references/commit-vs-gitignore.md — the two committed/gitignored strategies, their tradeoffs, and the exact CI gate each one requires.
• references/toolchain-and-workspace.md — SDK pinning, analyzer/coverage excludes, and the multi-package workspace layering (fenced, opt-in).

Run scripts/regen.sh (codegen → format → analyze) before a PR, and scripts/check-codegen-hygiene.sh to verify excludes and commit-policy parity.

Non-negotiable rules