Propagate module initialization and attribute control errors - #9712

Summary

Align Python 3.15 ModuleType initialization, attribute and annotation controls in nine Rust source files (+161/-149).

• Propagate dictionary callback failures during module initialization instead of expecting writes to succeed. Preserve the original string name and arbitrary doc object.
• Reuse one annotation/dir dictionary loader that honors overridden dict, while performing subsequent dictionary operations on raw storage. Preserve callback errors distinctly from missing keys and return direct dir hook results unchanged.
• Let descriptor AttributeError fall through to module getattr. Optional lookups skip missing-attribute diagnostics and their metadata callbacks.
• Share fallible import-spec initialization checks, propagate origin/state callback errors, and consult the parent's _uninitialized_submodules for circular-import diagnostics. Preserve metadata lookup and temporary-owner order.
• Add try_new_module for fallible initialization, propagate native-definition initialization errors, and use the fallible path for WebAssembly injection after user code has populated its globals.

Validation

Compared against pinned CPython d220409a13b77de7a6c30abe16ea90db01528edc moduleobject.c and import.c. All 45 external reference checks pass, including collisions in all five initialization writes, annotation dictionary overrides, dictionary-subclass bypass, callback failures, descriptor fallback and optional lookup behavior. Independent source/lifetime review passed, including the native initialization callers and generated module helper.

Final threaded cargo check passed (1m12s), all-target Clippy passed (3m11s) with exactly the 12 unchanged baseline diagnostics, and normal commit hooks passed. The final lifetime oracle also passed independently in three fresh CPython processes.

Limits and integration

The initialization panic path is source-established, not a native RustPython crash reproduction. Native execution remains unperformed because its required safety guard is not verified. No repository tests, markers, Lib files or workflows were changed. Hosted runtime CI remains necessary.

The changed WebAssembly call site was source-reviewed but its separate wasm/non-threaded dependency graph was not compiled locally due limited disk space. The threaded VM/stdlib check does not substitute for that target validation.

The existing public new_module wrapper remains infallible for callback-free dictionaries. External embedders supplying user-controlled dictionaries must use try_new_module. All in-tree pre-initialization dictionary callers were reviewed; WebAssembly's executed-globals path is migrated.

#9700's Unicode annotation-result diagnostic change remains separate and should be preserved on composition. Existing import-from name/sys.modules suppression and file fallback differences, super error controls, and broader import behavior are outside this patch. The shared spec changes do not claim full import diagnostic parity.