Function lower_protocol_ir_from_commons 

pub fn lower_protocol_ir_from_commons(
    protocol: &ServiceProtocol,
    commons: &TypedCommons,
) -> ProtocolIr

P6.24a: a TypedCommons-only sibling of lower_protocol_ir, the same split lower_op_sig_ir/lower_op_sig_ir_from_commons already established — for a call site holding only a unit’s own TypedCommons, never a &CheckedProgram (emitter.rs’s emit_project_imports, a header-import-collection pass that runs well outside the per-declaration emission loop any CheckedProgram is threaded through). Sound for the identical reason: this function never calls LowerIrCtx::expr_ty, the one method whose .expect()-panic needs a genuinely certified program.