selfhost+test: route N_TSLICE variant through shape-aware index helper (#19)

Class A wwstage cgen miscompile, silent until wwstage path engaged.
Pre-fix wwstage's name-keyed flatvariantidx returned -1 for `[]T`
variants (pat.str empty on N_TSLICE), so cgmatch and
cgtagvariantidx collapsed every `(scalar | []T)` arm to tag 0.
Internally consistent within wwstage; cstage's structural
`type_eq` (cmd/w6c/cgen.c:466 cg_tag_for_variant) matched
correctly. Bootstrap stayed green because no selfhost-corpus path
exercises `(scalar | []T)` until lib/bytes / lib/strings landing
pulls bytes.index through wwstage compilation — 967_bytes_run
uses `ww run` (cstage only), so the wwstage path was never
exercised.

Polarity catalog entry: wwstage UNDER (missing N_TSLICE dispatch
arm in variantindex lookup), not REVERSE — worker's deeper read
corrected rob's initial diagnosis. cstage's structural type-eq is
the leaner-correct side; wwstage converges to it per rule 10.

Fix: new `flatslicevariantidx` helper in cgenutil.ww keyed on
N_TSLICE shape walking pat.lhs against vt.lhs alongside the existing
name-keyed flatvariantidx; extend `taggedvariantindex` shape-fallback
with a `wantslice == ivisslice` axis alongside the existing str
axis; route N_TSLICE in cgenexpr.ww's cgtagvariantidx (is/as)
and cgmatch (case) through the helper. No edits to cgenmatch's
dispatch codegen (CMPQ/JNE/spill) — that's symptom, the bug is
in the variantindex lookup.

Surfaced the 7th corpus-coverage-blind unmask of session 5 (sister
shape to STATUS-4 #11 / #14 / #21 wwstage UNDER family). Latent
within lib/bytes (a6abac2) since landing today; 967_bytes_run's
cstage-only `ww run` driver kept it dormant.

Tests:
  - 722_match_slice_variant pins cmp -s byte-id between stages
    for the canonical (u8|[]u8), reverse-order ([]u8|u8), and
    three-arm (u8|[]u8|str) shapes.
  - 926_match_slice_variant_run runtime-pins 7 rows × 2 stages
    (cstage + wwstage drivers): canonical, reverse-order, and
    other scalar-vs-slice-of-same-primitive matrices (i8|[]i8,
    i32|[]i32, u64|[]u64, rune|[]rune), three-arm with str.
    Verifies both arms reachable and payload survives.

Filed follow-ups (latent, NOT in this commit's scope):
  - flatslicevariantidx falls back to first slice slot when no
    element-name matches; `([]u8 | []i32)` would mis-route. No
    in-tree consumer.
  - 926 missing nested ((u8|[]u8) | i32) row per rob's spec.
  - 3-arm 32B tagged sequential-push payload corruption (both
    stages, asm byte-id passes, only 9xx runtime catches).
  - Chained inline pick() over 32B 3-arm slot (both stages,
    bind-to-let workaround documented at 926 row).

93/93 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).

Makefile

@@ -248,6 +248,8 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_tagged_call_arg_run \
 	  $(BIN)/test_sret_struct_return \
 	  $(BIN)/test_sret_struct_return_run \
+	  $(BIN)/test_match_slice_variant \
+	  $(BIN)/test_match_slice_variant_run \
 	  $(BIN)/test_param_shadow_mod \
 	  $(BIN)/test_localoff_scope \
 	  $(BIN)/test_cast_enum_movl \
@@ -543,6 +545,16 @@ $(BIN)/test_sret_struct_return_run: test/wcc/925_sret_struct_return_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_match_slice_variant: test/wcc/722_match_slice_variant.c \
+		$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BIN)/test_match_slice_variant_run: test/wcc/926_match_slice_variant_run.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_use_promote_alias: test/wcc/699_use_promote_alias.c \
 		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
 		$(LIB)/libwwrt.a | $(BIN)