fix(compiler): check every clause under effect tags

new_changelogs/20261029T120000Z-fixed-effect-tags-multiclause.md

@@ -0,0 +1,4 @@
+- **Effect tags now cover every clause of a function.** `@pure`, `@no_fs`,
+  `@no_net`, and `@no_os` no longer accept a function when a later pattern
+  clause, or a later clause of a transitive callee, reaches a forbidden
+  capability.

tests/integration/effect_tags/reject_multiclause.ae

@@ -0,0 +1,7 @@
+import std.os
+
+@no_os
+status(0) -> 0
+status(n: int) -> os.system("echo hi") + n
+
+main() { status(1) }

tests/integration/effect_tags/reject_multiclause_transitive.ae

@@ -0,0 +1,9 @@
+import std.os
+
+helper(0) -> 0
+helper(n: int) -> os.system("echo hi") + n
+
+@pure
+run() -> helper(1)
+
+main() { run() }

tests/integration/effect_tags/test_effect_tags.sh

@@ -25,6 +25,8 @@ check_rejected() {
 check_rejected reject_fs fs
 check_rejected reject_transitive os
 check_rejected reject_net net
+check_rejected reject_multiclause os
+check_rejected reject_multiclause_transitive os
 
-echo "  [PASS] effect_tags: @no_fs / @pure-transitive / @no_net violations all rejected"
+echo "  [PASS] effect_tags: direct, transitive, and multi-clause violations all rejected"
 exit 0