ascii: graduate digitval to (i32 | void); selfhost tagged ABI follow-on

ascii.digitval returns (i32 | void) instead of an i32 -1 sentinel.
Two callers updated to match-on the result (lib/ww/lex/lex.ww escape
parse, selfhost/test/smoke.ww probe 6).

`!` would have been more idiomatic at both call sites — both have
verified isxdigit beforehand — but the selfhost parser doesn't yet
recognize postfix `!`/`?`, so using them in bootstrap-bound code
breaks the 993/995 byte-identity gates. Match is fine for now.

Selfhost cgen follow-on for the 8-byte-rounded tagged-union ABI
(landed in 1e2f55a for the C side):
- cgenutil.slotsize: tagged size = 8 (tag) + max(payload), padded to
  8-byte multiple. Was hardcoded 24.
- cgendecl prologue: spill size/8 arg registers, not always 3.
- cgenstmt cglet tagged-call path: spill the CX value-word only when
  the slot is >16 bytes.

All three were emitting 3-register patterns appropriate to (T | str)
sized unions and overflowing the new 16-byte (i32 | void) slots.

selfhost/cmd/wcc/cgenstmt.ww

@@ -184,15 +184,19 @@ fn cglet(c: *cgen, n: *node) void = {
 			};
 			cgexpr(c, rhs);
 			if (rhsreturnstagged) {
+				// Spill size/8 registers (tag + value words).
+				// Slots smaller than 24 don't carry a CX word.
 				emitline("\tMOVQ\tAX, ");
 				emitoff(off: i64);
 				emitline("(BP)\n");
 				emitline("\tMOVQ\tDX, ");
 				emitoff((off + 8): i64);
 				emitline("(BP)\n");
-				emitline("\tMOVQ\tCX, ");
-				emitoff((off + 16): i64);
-				emitline("(BP)\n");
+				if (sz > 16) {
+					emitline("\tMOVQ\tCX, ");
+					emitoff((off + 16): i64);
+					emitline("(BP)\n");
+				};
 				c.lastwasreturn = 0;
 				return;
 			};