[codex] Delete public WithHandler shim

[proboscis]

Summary

• Deleted the public Python WithHandler(h, body) compatibility shim and its deprecation-message constants.
• Added handler(raw_handler) as the explicit raw-dispatcher -> Program -> Program installer and exported it from doeff.
• Migrated Python and Hy call sites from public WithHandler(...) to direct h(body) composition or explicit raw-dispatcher wrapping.
• Kept deliberate VM-node coverage on doeff_vm.WithHandler and added architecture/semgrep guards against public shim reintroduction.
• Removed tests/test_withhandler_shim_deprecation.py and added tests/architecture/test_no_public_withhandler_shim.py.

Root Cause

doeff.program.WithHandler was a permanent compatibility shim that silently preserved two legacy paths: forwarding new-style handlers and wrapping raw @do dispatchers. That violated the no-compat-shim policy and kept the old idiom alive across tests/packages with runtime deprecation warnings.

Validation

Baseline on main before this branch:

• uv run python -m pytest tests -q -> 880 passed, 90 skipped, 55108 warnings in 54.51s
• uv run python -m pytest packages/doeff-conductor/tests packages/doeff-vm/tests -q -> 421 passed, 507 warnings in 33.49s

Final on this branch:

• uv run python -m pytest tests -q -> 881 passed, 86 skipped, 51 warnings in 66.23s
• uv run python -m pytest packages/doeff-conductor/tests packages/doeff-vm/tests -q -> 421 passed in 27.70s
• uv run pyright -> 0 errors, 0 warnings, 0 informations
• git diff --name-only --diff-filter=ACM -- '*.py' | xargs uv run ruff check -> All checks passed!
• grep -rn "from doeff.program import WithHandler\|program.WithHandler" --include="*.py" . -> 0 hits
• grep -rn "def WithHandler" doeff/ -> 0 hits
• grep -c "WithHandler(h, body)\|raw @do-dispatcher\|WithHandler.*deprecated" /tmp/core-withhandler-final-tests.log /tmp/core-withhandler-final-packages.log -> both 0
• semgrep scan with the new doeff-no-public-withhandler-shim rule only -> pass

Note: full-repo .semgrep.yaml still reports pre-existing unrelated findings, so I validated the new guard rule independently in addition to ruff/pyright/tests.

Refs: core-withhandler-compat-shim-delete