w6c+selfhost: widen concrete variant to tagged-union call arg

Tagged-union widening already fired for `let r: (str|rune) = "...";`,
`r = "...";`, and `return "..."` from a tagged-returning fn — but not
at call sites, so `fn f(x: (str|rune))` couldn't be called with a bare
str or rune. The arg was pushed as its own static type (2 words for
str, 1 for rune) while the callee's slot expected 3 (tag + payload).

C cgen: at the call boundary, look up the callee's declared param
type per arg. When the param is TY_TAGGED and the arg is a concrete
variant, materialise (tag, value-words, padding) sized to the param's
tagged_arg_size — then the existing pop-into-arg-regs logic picks it
up. Nullable `(*T | void)` collapses to a single 8B push.

selfhost: fnret now carries the params head alongside rtype (amalloc
bumped to 48); pushargsrev takes the matching param node and runs the
same widening sequence per arg. The pop drain in cgcall already
handled extra slot words, so no change needed on that side.

Verified with a smoke covering str/rune literals, typed locals,
pre-existing tagged-local pass-through, and nullable widening from a
raw pointer. Selfhost emits byte-identical asm to C cgen on the test.

selfhost/cmd/wcc/cgenexpr.ww

@@ -1961,7 +1961,17 @@ fn cgcall(c: *cgen, n: *node) void = {
 		};
 	};
 
-	let nargs: i32 = pushargsrev(c, n.list);
+	// Look up the callee's declared params for tagged-union widening.
+	// fn-pointer calls (callee is a local) don't get widening — the
+	// user must build the tagged value explicitly. Matches the most
+	// common case (direct named calls).
+	let calleeparams: *node = nil;
+	if (callee != nil) {
+		if (callee.kind == nkind.N_IDENT) {
+			calleeparams = fnparamslookup(c, callee.str);
+		};
+	};
+	let nargs: i32 = pushargsrev(c, n.list, calleeparams);
 	// Pop forward. Float args were pushed as 8 bytes from X0 via
 	// SUBQ+MOVSD; pop into the XMM stream (X0..X7). Everything else
 	// pops into the int stream (DI..R9) per the SysV ABI. Walk the