fix(map): validate calls and preserve lexical routing

[luisleo526]

Summary

• reject duplicate keyword arguments in the parser instead of silently keeping the last value
• bind recognized map calls through stable diagnostics for missing, duplicate, unknown, and excess arguments
• preserve lexical map receiver routing across globals, parameters, nested roots, block scopes, and request.security timeframe-expression clones
• fail closed when a synthetic call has no trustworthy source provenance

Validation

• focused map diagnostics and terminal-return tests: green
• full native pytest suite: green
• Pyodide parity: 277/277
• frozen 666 corpus: 661 OK / 5 existing errors, byte-identical SHA-256 289fa27b9b07271344d14ee67eaa4b1990a74f4494af13c589b78fc5a89e5121
• independent cold review: GO
• git diff --check: clean

Factorial evidence

• N=5 routing/diagnostics matrix: 32/32, publication gate true
• N=5 fingerprint: f5fa1621f969f7175d919d8ae19f4d10b7bd8690da676df800343ab8d57398ba
• N=5 manifest / summary SHA-256: d2a15683b3f666ee811d066693db115eeda549def9a9597d222e1e25a85030ad / 034dd12de730130cd84a587ac830b9a4b85c0e6b070ef6cb6900e9510b450b18
• N=2 security-clone matrix: 4/4, publication gate true
• N=2 fingerprint: 39c5df73ff7db803a5e8f74a4cc882f57fa2f2c533d65bfbdff40943709c7d70
• N=2 manifest / summary SHA-256: 9d3a852c350ec998820bb341beef9e6c3d18e292f3283b4135b9bd87a4f35e71 / b44e1d5de395e158b0f104b3747ac99e426a70279b7df58a123c871071154c78
• candidate PATCH SHA-256: 2b2a1eff708276cfcfd3818281a013247045912b8fadad30363e25c902cf3fbf

Provenance

• tested commit: 2125357
• tested tree: 2d08a78bae0de12d6df33912a458914538d5d843

This milestone is intentionally score-neutral; PineMap semantic codegen integration remains a separate atomic change.