P-007: remaining POOL004/POOL005 slices — view stored into another field; deeper escape shapes

[PhysShell]

Agent brief — tier: mid (above-average). One PR (Closes #<this>); branch from main. House rules: AGENTS.md.

Goal

ROADMAP milestone 4 lists the remaining Pool/Span slices: POOL005 for a full-length view stored INTO another field (today: local and pooled-byte[]-field reads are covered) and deeper POOL004 escape shapes. POOL001–POOL003 are end-to-end; this extends working machinery, not new architecture.

Sources of truth

• docs/proposals/P-007-arraypool-span.md — the pattern family, non-goals included.
• Existing POOL001–POOL005 fixtures and tests — the style and pinning conventions to follow.
• docs/ROADMAP.md milestone 4 — the exact remaining list.

Deliverable

• Core (+ extractor where the shape needs C# facts) support for the two slices, each with bad/ok fixtures pinned in tests.
• If a slice turns out to require interprocedural reasoning beyond the current machinery, stop, and record the boundary in the PR description (a deliberate deferral beats a soft false positive).

Guardrails

• Precision-first: ambiguous flows stay silent or warning-tier per the house severity tiering — never a hard error on an unproven shape.
• No FP regressions on the existing corpus: python tests/run_tests.py must stay green, and existing ok-fixtures must stay clean.
• C# extractor changes are CI-validated only (no local dotnet).

Done when

New fixtures pinned (bad flags with the expected code, ok stays silent), full test suite + ruff check . + mypy green.