wcc/cgen: #87 plain tagged-union module-global DATA + match SB-resolution (both-stage)

A PLAIN (non-alias) module-level tagged-union global SEGV'd on BOTH
stages: no static DATA was emitted (let_emit_size/letemitsize returned 0
for TY_TAGGED) so the global was never registered, and the match
scrutinee resolved it as a frame-local at offset 0 — reading saved BP as
the tag. Two sub-sites, one route (neither half ships alone — DATA
without SB-resolution still SEGVs; SB-resolution without DATA reads
nothing):

(a) DATA-emitter — a non-nullable TY_TAGGED arm emits the box that
    byte-MIRRORS a runtime LOCAL of the same type: tag word at +0 (the
    const-selected variant index via cg_tag_for_variant / taggedvariant-
    index), payload at +8, zero-padded to the union box size. int and
    str/slice literal variants are wired (str carries a DATAR ptr patch
    at +8); any other variant payload loud-stops (rule 7). emit_tagged_
    data + emittaggeddata are the per-stage twins; let_pre_intern/
    letpreintern gain the matching str-variant intern. Nullable stays 0
    so the (*T|void) one-word fold keeps the 8B scalar arm.

(b) match-scrutinee global resolution — the PLAIN-tagged twin of #78:
    a global tagged ident scrutinee LEAQs name(SB) and copies the box
    into an @match_spill slot the dispatch indexes off BP.

DATA target (mirror of the local box, verified byte-for-byte): for
(i32|str)=42 the 32B box is tag0 | 42@8 | zero-pad; for ="x" it is
tag1 | ptr0@8(DATAR _S_n) | len@16 | cap@24. cs and ww emit byte-
identical asm.

Pins (rob §3, dual-stage 910 cstage + 997 wwstage, attest_pass.ww): the
tagged global-vs-local byte-identity pin (match over the GLOBAL gives the
same arm/value as over a LOCAL — was SEGV both stages) and the str-
variant tag-1 pin, plus the #86 tuple global-vs-local lock-pin guarding
the already-correct emitter path.

929 fail_global_src graduates: a >48B tagged GLOBAL by-value arg now
resolves through the cgplaceaddr MEMORY-class arm (LEAQ g(SB) + blit)
instead of the #38b loud-stop, and runs correctly (uninit zero box ->
first variant); the row becomes a positive run pin. The struct-variant
>48B init still loud-stops via the data emitter.

The first-class-VALUE copy of a tagged ident (`let q = g`) stays a
pre-existing silent #49/#46 sibling (local and global identically),
filed separately — out of this fold's two sub-sites.

selfhost/cmd/wcc/cgenexpr.ww

@@ -2554,7 +2554,33 @@ fn cgmatch(c: *cgen, n: *node) void = {
 			if (lc != nil) {
 				scrutoff = lc.off;
 				scrutt = resolvetagged(c, lc.tnode);
-			};
+			} else { if (isletvar(c, scrut.str)) {
+				// #87: a tagged-union GLOBAL scrutinee — the box lives
+				// in static DATA at name(SB), not the BP frame.
+				// localfindnode returns nil and the dispatch would read
+				// saved BP as the tag (garbage). The PLAIN-tagged twin
+				// of cstage #78 SB-resolution: LEAQ the address, copy
+				// the box into an @match_spill slot indexed off BP.
+				let gtt: *node = resolvetagged(c, letvartnode(c, scrut.str));
+				if (gtt != nil && !isnullabletype(gtt)) {
+					scrutt = gtt;
+					let gspill: i32 = matchspillsz(c, gtt);
+					scrutoff = localalloc(c, "@match_spill", gspill, nil);
+					emitline("\tLEAQ\t");
+					emitsymnamehint(c, scrut.str, c.curmod);
+					emitline("(SB), AX\n");
+					let gk: i32 = 0;
+					for (gk < gspill) {
+						emitline("\tMOVQ\t");
+						emitdispreg(gk: i64, "AX");
+						emitline(", DX\n");
+						emitline("\tMOVQ\tDX, ");
+						emitoff((scrutoff + gk): i64);
+						emitline("(BP)\n");
+						gk += 8;
+					};
+				};
+			}; };
 		} else {
 			// Non-ident scrutinee (call result, arr[i], p.field,
 			// ?, etc.). Spill into an `@match_spill` scratch slot