wcc: str -> 24B {ptr,len,cap}, 3-reg ABI -- parity with []u8 (both stages)

A ww `str` becomes a 24-byte {ptr,len,cap} value, identical in layout to
[]u8 -- the enabling prerequisite for the Phase 2 `str == []u8` collapse.

Both stages, atomically:
- ty_str 16->24B; str value flows 3-reg AX/BX/CX (was 2-reg); str literals
  emit cap (=len).
- str in a tagged union grows to a 32B slot, using the AX/DX/CX/R8 4th-word
  path already used by 32B slice-variant unions -- str-variant is now
  structurally identical.
- tuple (scalar,str) return: 4-reg AX/DX/CX/R8 + 32B receive, extending the
  existing type-keyed return (no sret).
- str == []u8 for index and .ptr/.len/.cap, kind-gated where size-based
  dispatch collided at 24B; cstage and wwstage mirror exactly.
- table-driven runtime coverage: test/wcc/928_str_abi_run.c.

Cannot be split (rule 10/11): a 24B str and a 16B str cannot coexist across
the two compiler stages without breaking byte-identity, so the size change
and every dependent ABI/codegen site land in one atomic commit, both stages.

Known follow-ups (zero corpus impact, tracked): str-literal global .cap
static-init; >16B struct by-value (pre-existing); tagged-union
match-scrutinee stage divergence (pre-existing).

cmd/wcc/type.c

@@ -60,8 +60,10 @@ typesinit(Arena *a)
 	ty_uintptr= prim(a, TY_UINTPTR,"uintptr", 8, 8);
 	ty_f32    = prim(a, TY_F32,    "f32",     4, 4);
 	ty_f64    = prim(a, TY_F64,    "f64",     8, 8);
-	/* str is { *u8, len } — 16 bytes on amd64. ABI: pointer + u64. */
-	ty_str    = prim(a, TY_STR,    "str",    16, 8); /* sizelint-ok: SSoT for ty_str (#64) */
+	/* str IS []u8: { *u8, len, cap } — 24 bytes, 3-reg ABI (#1/Phase 3).
+	 * Size sourced from the slice SSoT (type_slice) so str and []u8 can
+	 * never drift; no second hardcoded 24. */
+	ty_str    = prim(a, TY_STR,    "str",    type_slice(a, ty_u8)->size, 8);
 	ty_err    = prim(a, TY_ERR,    "<err>",   0, 1);
 	ty_never  = prim(a, TY_NEVER,  "never",   0, 1);
 	/* #29: predeclared `type nomem = !void;`. NAMED so variant_match