a target object could impersonate the metadata proxy and kill the whole run

[devdanzin]

Found while triaging the smoketest fleet on the new machine. 15 of 29 fusil runs — about
half the wall clock — died with the same generator crash:

TypeError: '_ShutdownTheme' object is not callable
  write_python_code.py:343 in _get_object_methods

What happened

_MetaProxy was identified by duck-typing: getattr(obj, "_fusil_is_meta", False). Any object
with a catch-all __getattr__ answers that truthily — and CPython 3.16 ships one,
traceback._ShutdownTheme, the stand-in used when _colorize cannot be imported during late
shutdown:

class _ShutdownTheme:
    """Empty stand-in if `_colorize` cannot be imported during late shutdown."""
    def __getattr__(self, _): return self

So generation took the metadata branch on it and called _fusil_raw_methods() — which returns
the theme again, and is not callable.

Two things make this worse than a bad session:

• the TypeError escapes into the MAS and terminates the fusil process, so the fleet
  supervisor restarts the instance from scratch and the run's progress is lost;
• it fires with --discover-in-target off, where no proxy can exist at all, so the flag
  should never have been consulted in the first place.

Three more sites had the same hole

get_arg_number and class_arg_number read _fusil_arity / _fusil_ctor_arity off whatever
answered the flag, and _fuzz_one_module_object read _fusil_class_name. All four now go
through one is_meta_proxy().

Why isinstance, and why a new module

isinstance is the only check a target cannot forge. Moving the lookup to type(obj) would
fix _ShutdownTheme but not a hostile metaclass with __getattr__ — and fusil injects
those deliberately (the metaclass bombs), so that variant is tested too.

isinstance needs the class visible to both the generator and the arity code, and
write_python_code already imports arg_numbers — so _MetaProxy moves into its own module
rather than being imported cyclically. write_python_code re-exports it, so nothing else
changes.

Tests

tests/python/test_meta_proxy.py: a real proxy is recognised; a catch-all __getattr__
cannot impersonate one (asserting first that the old check was truthy on it, so the test
would have caught this); a hostile metaclass cannot either; ordinary objects are not proxies;
and both arity helpers fall through to their normal path instead of reading forged metadata.

1291 tests OK, ruff check and ruff format --check both clean.