wcc: resolve value-receiver field-call type via callee, not global leaf (#208)

wwstage exprtype's N_CALL arm fell into a global-leaf scopelookup for an
N_DOT callee with a value or chained receiver, binding whatever same-named
global headed the scope bucket. Under a late-os combined.ww concat order
this resolved io's `s.read(...)` to os.read (i64) instead of the field's
fn type, so checkretassign confidently rejected a valid tagged return — an
import-order-sensitive false positive. cstage resolves a call result solely
from the callee expr's own type (check.c:1378-1433, mirroring harec
check_autodereference 1566-1581); drop the global-leaf else-arm so value
and chained receivers fall through to the existing fn-VALUE path at
check.ww:2455. SK_USE module-qualified calls are unchanged.

ww has no methods, so `value.leaf()` is only ever a fn-ptr field access; the
global hit was never legitimate. Zero .s delta across all 5 bootstrap tools
(the branch is dead in the bootstrap); test 776 graduates to both stages
(os-late order, byte-identical).

The fix unmasks a pre-existing wwstage cgen bug (#211): cgen also re-derives
a call's return shape by name (fnretlookup), so a value-receiver field call
whose leaf collides with a same-named global of a different register shape
mis-resolves cs!=ww. Documented at the cgen site; pinned cstage-only by
test/wcc/782 (graduates to STAGE_WW on #211 close).

selfhost/cmd/wcc/cgen.ww

@@ -2235,6 +2235,26 @@ fn collectfnrets(c: *cgen, file: *node) void = {
 // return type (str-pair shuffle, tagged-union ABI, tuple destructure,
 // float ABI, sret slot sizing, fn-rvalue LEAQ, slice flow) fires
 // against the wrong-module shape.
+// fnretlookup — the called fn's declared return type, keyed by NAME
+// (same-module-first, then first leaf match). The receive sites that
+// re-derive a call's result SHAPE from this (cglet tagged-store,
+// cgwidentaggedstore scalar-vs-tagged classify, tuple/sret/unsigned
+// arms) are correct only when the leaf name uniquely picks the callee.
+//
+// #211 (gate-blind cgen divergence, sibling of the #208 checker fix): a
+// VALUE-receiver fn-pointer FIELD call `s.f(...)` reaches the receive
+// sites keyed on the field leaf `f` with the receiver VARIABLE name as
+// the "module" (not a real module), so this lookup mis-binds a same-named
+// GLOBAL fn. When that global's register shape differs from the field's
+// (scalar global vs tagged field), the slot is stored with the wrong ABI
+// shape → cstage≠wwstage asm, silent miscompile. The sound fix derives
+// the result from the FIELD's fn type / the checker-stamped n.type_ (as
+// cstage does, cmd/wcc/check.c:1378-1433), not by leaf name. NO guard is
+// added here: same-shape leaf collisions resolve by name legitimately
+// today, and a discriminating guard would need the shape-compare that IS
+// the fix. Masked until #208 landed (the checker rejected the shape
+// before cgen ran). test/wcc/782 pins the cstage-correct runtime
+// (cstage-only) and graduates to STAGE_WW on #211 close.
 fn fnretlookup(c: *cgen, name: str) *node = {
 	let f: *fnret = c.fnrets;
 	for (f != nil) {