wcc: ? error-subset propagation typecheck + tag remap

`expr?` previously did a brain-dead RET through whatever AX/DX/CX
held — only safe when operand and enclosing fn had identical variant
ordering. Tests relied on that alignment by construction.

Now:
- Typecheck: each non-first variant of operand must appear as a
  variant of the enclosing fn's return tagged union. Enclosing must
  itself be tagged (a non-tagged return has no slot for errors to
  land in).
- Cgen: on tag != 0, walk operand's error variants and emit a
  conditional tag remap (cmp/jne/mov/jmp) for any whose index in
  enclosing differs from operand's. Identity cases emit nothing,
  so same-shape operands cost zero extra instructions.

Selfhost cgen doesn't implement N_TRYPROP at all (no selfhost source
uses `?`); byte-identity tests still pass.

One existing e2e row used `?` with main returning i32 — relied on
the old loose semantics. Switched to `!` (abort-on-error); it was
exercising success-unwrap, not propagation.

test/wcc/300_check.c

@@ -124,6 +124,17 @@ static const struct row rows[] = {
 	  "ok" },	/* default arm absorbs missing variants */
 	{ "fn die() never = { for (true) { let _: i32 = 1; }; }; "
 	  "fn f() i32 = { die(); };", "ok" },	/* never assignable to anything */
+
+	/* ? error-subset propagation typecheck */
+	{ "fn inner() (i32 | str) = { return 1; }; "
+	  "fn outer() i32 = { let v: i32 = inner()?; return v; };",
+	  "enclosing function must return a tagged union" },
+	{ "fn inner() (i32 | str | bool) = { return 1; }; "
+	  "fn outer() (i64 | str) = { let v: i32 = inner()?; return v: i64; };",
+	  "error variant bool not in enclosing return" },
+	{ "fn inner() (i32 | str | bool) = { return 1; }; "
+	  "fn outer() (i64 | bool | str) = { let v: i32 = inner()?; return v: i64; };",
+	  "ok" },	/* reversed-order error subset is OK */
 };
 
 int