Post-reload call-consistency check for the dev hot reloader.

arizona_reloader hot-loads recompiled modules one at a time. Nothing otherwise verifies that the set of loaded modules stays call-consistent after a wave, so two common dev situations leave the node running a mix of module versions that each compile fine but cannot call each other:

• an exported function changes arity (or is renamed) in module A while a caller B is not recompiled/reloaded in the same wave -- because the build tool skipped it on stale _build beam mtimes (a branch switch, or another checkout stamping beams newer than the sources), or because the reload batch raced;
• a module is running from a beam that is older than its source on disk.

The mismatch stays silent until the first runtime call, which raises undef. When that call sits on a hot path (a per-tick gen_server), the process crash-loops, exhausts its supervisor's restart intensity within seconds, and takes the whole tree down -- while route serving keeps working, so the app looks up but is dead behind it. The mismatch is machine-detectable the moment it exists.

What this does

After each reload wave the reloader calls check/1, which:

1. Collects the just-reloaded module set from the changed .erl files (reloaded_modules/1), keeping only modules that are currently loaded.
2. For every loaded application module (candidate_modules/0 -- the loaded set minus OTP, filtered to modules with a readable beam file), reads its static external-call table and reports every edge into a reloaded module whose target function the reloaded module no longer exports (broken_edges/2).
3. Optionally flags any loaded module whose in-memory version differs from its beam on disk (stale_modules/1), which catches the mtime-skip case even before a call breaks.
4. Logs one loud warning per finding, naming the caller and the missing MFA.

The two edge signals are complementary. A caller's call table is read from its beam on disk, so broken_edges/2 catches the classic stale-caller-on-disk case (the caller was never recompiled). stale_modules/1 catches the opposite case -- a caller whose disk beam is fresh but whose in-memory code is stale -- via the version mismatch.

Detection mechanism

The static call table comes from the beam imports chunk via beam_lib:chunks/2 (stdlib), not xref -- so there is no runtime dependency on the tools application and no xref server to start. Dynamic calls (apply/3, behaviour callbacks resolved at runtime) are invisible to the import table; that is fine, the check is best-effort and the static case is the one that bites.

The pass runs synchronously in the watcher on every save, over every loaded non-OTP module, so its disk work is kept minimal: each candidate's imports and attributes (vsn) chunks are fetched in one beam_lib pass, and the result is cached across waves keyed by the beam file's path + mtime -- an unchanged module costs one stat per wave, not repeated full reads. The wave's just-reloaded modules are evicted up front (their beams were rewritten, and an mtime has whole-second resolution), so their fresh facts are always re-read.

The cache table is created and owned by arizona_sup (create_table/0), not by whichever process runs a check, so that "one stat" holds for every caller -- including the dev MCP tools, whose checks run in a per-dispatch process that exits as soon as it has answered.

The whole pass is best-effort: it runs only on a successful reload (dev mode), finds nothing and logs nothing on a clean wave, and never crashes or interferes with the reload -- check/1 wraps everything in a catch-all.