w6c+selfhost+lib: cgen quality batch + lib Hare-shape graduation

Six fixes across the toolchain, surfaced by lib/lisp porting work.

  1. f64 compound assigns (`acc += d`, `-=`, `*=`, `/=`). Both stages
     load slot → X1, OP X0 into X1, store back (ADDSD/SUBSD/MULSD/
     DIVSD are reg-reg only). Previous MOVSD-overwrite dropped the
     OP. Locals and top-level lets.

  2. Top-level `[N]u8` arrays + `&arr[i]`. let_emit_size grows a
     TY_ARRAY branch so zero-init DATAW lands; cgindex / N_INDEX
     store / `&base[i]` all detect a global array base and use
     LEAQ name(SB) instead of LEAQ (BP). TK_AMP no longer pre-
     evaluates the operand as a value-load — `&base[i]` computes
     base + i*esz directly. Unblocks Hare's static-buffer pattern:
     strconv.{u64,i64,f64}tos graduate to module-level `*_buf`
     arrays and return owned views.

  3. Cross-module `pkg.Enum.MEMBER`. Nested N_DOT chains that
     don't fold to a known shape now emit `MOVQ <leaf>(SB), AX`
     (mirrors the bare-IDENT unresolved fallback), so isolation
     probes — and the test 990 cgen-match floor — stay consistent
     across stages. strconv exposes `base` as a real `enum i32`;
     callers updated. The `main` exemption (linker entry-point
     keeps bare name even when not exported) mirrors C-side
     collectmods into selfhost cgendecl.

  4. Sum-typed parameter ABI. lib/bytes.{index,rindex} take
     `(u8 | []u8)` needle; lib/strings.byteindex / rbyteindex take
     `(str | rune)` needle (Hare-shaped; the byte-wise misnomer
     `index` is dropped). tagged_arg_size cap bumps to 48 (6 int
     regs), with a new partial-fit branch on the callee: when an
     N-word tagged arg overflows remaining regs, fill what fits and
     stitch the rest from positive BP offsets. scanlocals MCASE
     handles slice binds (24B) and walks each arm with a saved /
     restored seenmark set so two arms naming the same local each
     get their own slot — matches cstage's per-arm scope reset.

  5. 4-reg tagged-return ABI (AX=tag, DX=word0, CX=word1, R8=word2),
     up from 3 regs. Slice-payload variants (`([]T | E)`, slot 32B)
     round-trip ptr/len/cap end-to-end. Every receive site updates:
     let-init via cgwidentaggedstore, match scrutinee spill, cgindex
     tagged-element load (both N_IDENT and fallback bases),
     pushargsrev tagged-ident arg (reads word count from slot size),
     cgreturn slice variant in the shuffle path.

  6. `expr: TaggedAlias` is a widening, not a re-interpret. C cgen +
     selfhost cgwidentaggedstore peel an N_CAST whose destination IS
     the union — so cgexpr's natural shape (str: AX=ptr, BX=len;
     slice: AX=ptr, BX=len, CX=cap) is consumed by the matching
     concrete-variant branch instead of being misread as a tagged
     AX/DX/CX triple. Inner casts to a concrete variant (`7: i32`)
     keep their type for proper tag lookup. `[N]Alias` arrays
     resolve element size via slotsize + aliaslookup, and aliaslookup
     strips a `pkg.` prefix so cross-module references work.

lib/fmt grows `formattable = (i64 | str | bool | rune)` plus
`printv` / `printlnv` taking an explicit `[]formattable` slice (the
receive side of Hare's `args: formattable...`). Call-site variadic
gather isn't wired — callers either hand-build the slice or compose
strconv.i64tos + strings.concat.

700_e2e: 114 → 123 rows (f64 compound, top-level u8 arrays + `&buf[i]`,
pkg.Enum.MEMBER, sum-typed (str|rune) and (u8|[]u8) params, 4-reg
slice-return ABI, formattable array). 26/26 tests, bootstrap stable
through ww4.

lib/CLAUDE.md

@@ -13,29 +13,38 @@ Signatures mirror Hare too, modulo:
 - Tagged-union returns are spelled with the ww `!` error tag where
   Hare uses `!void` / `!T`, and indices use the underlying length
   type (`i32` today, since `str.len: i32`). Example:
-  `strconv.stoi64(s: str, b: i32) (i64 | invalid | overflow)` —
-  same shape as Hare's; the base parameter is plain `i32` rather
-  than a `base` enum because cross-module `mod.enumtype.VALUE`
-  chains miscompile in the cstage cgen. `strconv` exports
-  `def DEC: i32 = 10;` etc. so callers say `strconv.DEC` and the
-  Sdef path lowers to an immediate.
+  `strconv.stoi64(s: str, b: strconv.base) (i64 | invalid | overflow)`
+  — same shape as Hare's. The base parameter is the named enum
+  `strconv.base` (Hare uses `enum uint`; we pick `enum i32` to
+  match the index type).
 
-- Owned-`str` returns. Where Hare returns `const str` into a
-  thread-local static buffer (`strconv.i64tos`, `strings.dup`,
-  `strings.concat`), ww allocates per call and the caller frees
-  via `os.free(r.ptr, r.len: u64)`. Mutating a module-level `*u8`
-  doesn't yet round-trip through the wwstage cgen, so the static-
-  buffer shape isn't expressible today.
+- Static-buffer `str` returns where Hare uses them. `strconv.*tos`
+  returns a `const str` view into a module-level buffer that is
+  overwritten on the next call to the same function. Callers that
+  need the bytes to outlive the next call duplicate via
+  [[strings.dup]]. Functions that genuinely allocate a fresh
+  buffer (`strings.dup`, `strings.concat`) still return an owned
+  `str` that callers free via `os.free(r.ptr, r.len: u64)`.
 
-- Variadic ABI doesn't land yet, so callers that Hare writes as
-  `fmt::println(42)` are spelled `fmt.println(strconv.i64tos(42,
-  strconv.DEC))` for now. `lib/fmt` is intentionally print-string-
-  only — no `printf`-family.
+- Call-site variadic sugar (`fmt::println(42)`) doesn't land yet.
+  The receive side does — `fmt.formattable` is a tagged union of
+  the printable scalar types, and `fmt.printv` / `fmt.printlnv`
+  take an explicit `[]formattable` slice. Until the call-site
+  gather is implemented, callers either hand-build the slice:
+      let args: [2]fmt.formattable;
+      args[0] = "count: ": fmt.formattable;
+      args[1] = 42i64: fmt.formattable;
+      fmt.printlnv(args[0:2]);
+  or compose to a single str via strconv.i64tos + strings.concat:
+      fmt.println(strconv.i64tos(42, strconv.base.DEC));
+  `lib/fmt` is intentionally print-string-only — no `printf`-family.
 
-- `(str | rune)`-style sum-typed parameters are split into typed
-  pairs (`strings.indexbyte` for the byte case, `strings.index` for
-  the slice case, etc.). The Hare public name `byteindex` will come
-  back once the sum-typed parameter ABI lands.
+- `(T | U)` sum-typed parameters dispatch via `match` inside the
+  callee. `strings.byteindex(haystack: str, needle: (str | rune))`,
+  `bytes.index(s: []u8, needle: (u8 | []u8))`, and `rbyteindex`/
+  `rindex` follow Hare's shape directly. The rune-indexed
+  `strings.index` (rune-wise position) isn't shipped yet — we don't
+  have UTF-8 rune iteration in the language stack.
 
 Don't ship a richer surface than Hare has. A documented subset is
 fine; an extension, rename, or convenience-wrapper is not — callers