evaluator: "field not allowed" regression when embedding a struct value

[myitcv]

What version of CUE are you using (cue version)?

$ cue version
cue version v0.0.0-20241230133743-46fc54aa9caf

go version go1.23.2
      -buildmode exe
       -compiler gc
  DefaultGODEBUG asynctimerchan=1,gotypesalias=0,httpservecontentkeepheaders=1,tls3des=1,tlskyber=0,x509keypairleaf=0,x509negativeserial=1
     CGO_ENABLED 1
          GOARCH arm64
            GOOS linux
         GOARM64 v8.0
             vcs git
    vcs.revision 46fc54aa9caf95393dcd3fe0ac066c8112da986d
        vcs.time 2024-12-30T13:37:43Z
    vcs.modified false
cue.lang.version v0.12.0

Does this issue reproduce with the latest release?

n/a - relevant only at tip.

What did you do?

# setup
env HOME=$WORK/_home
exec cue mod tidy

# -- evalv2 --
env CUE_EXPERIMENT=evalv3=0

# case 1
exec cue export trybot.cue case1.cue
cmp stdout stdout.golden

# case 2
exec cue export trybot.cue case2.cue
cmp stdout stdout.golden

# -- evalv3 --
env CUE_EXPERIMENT=evalv3=1

# case 1
exec cue export trybot.cue case1.cue
cmp stdout stdout.golden

# case 2
exec cue export trybot.cue case2.cue
cmp stdout stdout.golden

-- cue.mod/module.cue --
module: "cue.example"
language: {
	version: "v0.12.0"
}
deps: {
	"github.com/cue-tmp/jsonschema-pub/exp1/githubactions@v0": {
		v: "v0.4.0"
	}
}
-- trybot.cue --
package github

import (
	"github.com/cue-tmp/jsonschema-pub/exp1/githubactions"

)

workflows: trybot: githubactions.#Workflow

workflows: trybot: {
	name: "trybot"

	on: {
		push: {}
	}

	jobs: test: {
		"runs-on": "ubuntu-22.04"

		steps: [
			{
				run: "echo hello"
			},
		]
	}
}
-- case1.cue --
package github

import (
	"github.com/cue-tmp/jsonschema-pub/exp1/githubactions"
)

workflows: {
	trybot: githubactions.#Workflow
}

-- case2.cue --
package github

import (
	"github.com/cue-tmp/jsonschema-pub/exp1/githubactions"
)

workflows: {
	{
		trybot: githubactions.#Workflow
	}
}

-- stdout.golden --
{
    "workflows": {
        "trybot": {
            "name": "trybot",
            "on": {
                "push": {}
            },
            "jobs": {
                "test": {
                    "runs-on": "ubuntu-22.04",
                    "steps": [
                        {
                            "run": "echo hello"
                        }
                    ]
                }
            }
        }
    }
}

What did you expect to see?

A passing test.

What did you see instead?

# setup (0.675s)
# -- evalv2 -- (0.000s)
# case 1 (0.040s)
# case 2 (0.062s)
# -- evalv3 -- (0.000s)
# case 1 (0.052s)
# case 2 (0.091s)
> exec cue export trybot.cue case2.cue
[stderr]
workflows.trybot.jobs.test."runs-on": field not allowed:
    ./_home/.cache/cue/mod/extract/github.com/cue-tmp/jsonschema-pub/exp1/[email protected]/Workflow.cue:529:48
    ./trybot.cue:18:3
[exit status 1]
FAIL: /tmp/testscript2414922344/repro.txtar/script.txtar:24: unexpected command failure

The relevant diff between case1 and case2 is as follows:

--- case1.cue   2024-12-30 16:48:39.366920542 +0000
+++ case2.cue   2024-12-30 16:48:39.366920542 +0000
@@ -5,6 +5,8 @@
 )

 workflows: {
-       trybot: githubactions.#Workflow
+       {
+               trybot: githubactions.#Workflow
+       }
 }

i.e. the trybot field is "wrapped" in case2 where it is not in case1. But we know for all A that {A} is equivalent to A so this should be harmless.