Function model_internal_actions 

pub fn model_internal_actions(model: &Model) -> BTreeSet<&'static str>

The single shared source of truth every surface consults exactly once: the set of wire verbs ("list", "get", "create", "update", "delete") a model’s @@internal(...) attributes suppress. Assumes every attribute already parsed successfully via parse_internal_attribute — per-declaration validation (cratestack-parser’s validate_internal_attribute) must run first and reject anything else, mirroring computed_params_type_name’s same assume-validated contract. Malformed or unrecognized attributes are silently skipped here rather than panicking: a caller reaching this function after a failed parse would already have surfaced the error at schema validation time, and this function must stay infallible so every codegen surface can call it without threading a Result through unrelated emission code.