test: migrate global value r/w family-5 to test/lang @test, retire C twins (fold-2)

Continue fold-2: migrate the global-value read/store/addr-of family (non-tagged)
from bespoke build+run C twins to test/lang @test, retiring each twin in the
same commit. Runtime coverage MOVES from $(TESTS) to test-lang (T1 runs+asserts
via `ww test`) + test-lang-byteid (T2 keeps cs==ww .s byte-id); the $(TESTS)
headline drops 3 (421->418). All asserts are primitive int comparisons; fresh
globals are zeroed, so a store that misses the symbol reads back 0 and FAILS.

  989_globptrfield_run.c  -> glob_ptr_field_test.ww  (scalar field store through a module-global *struct pointer loads the pointer from gp(SB), not saved BP; runtime gp=&backing form, static-init is #48-blocked)
  989_globstructret_run.c -> glob_struct_ret_test.ww (returning a module-global struct ident by value copies g's bytes; rsz 16 + rsz 24, each field asserted)
  989_dotbasehijack_run.c -> dotbase_hijack_test.ww  (indexing an [N]T field of a module-global struct addresses the struct field, not an unrelated global sharing the field name; +typed-inner control +colliding-global-intact pin)

glob_ptr_field keeps only the .c's offset-0 row: an added non-zero-offset row
(gp.g=9) surfaced a cs!=ww divergence (cstage folds the offset into the store
displacement `MOVQ AX,8(BX)`; wwstage emits `ADDQ $8,BX; MOVQ AX,(BX)`) — a
latent global-*struct-pointer field-store divergence beyond the .c's coverage,
reported for the backlog, not carried here. Bump LANGBYTEID_EXPECTED_MIN 35->38.

test/lang/dotbase_hijack_test.ww

@@ -0,0 +1,45 @@
+// dotbase_hijack_test — indexing an `[N]T` field of a module-GLOBAL struct
+// (`gs.fld[i]`) must address gs's field, not be hijacked by an unrelated
+// module-global that shares the FIELD's name, migrated from
+// test/wcc/989_dotbasehijack_run.c (F8-c4, report-item #20). wwstage's
+// dotbaseaddr #128b probe did `letvartnode(base.str)` (base.str = the DOT's
+// FIELD name) whenever the inner ident wasn't a local; for `gs.fld` with gs a
+// module-global struct, the inner is global so the probe fired and, finding the
+// unrelated global `fld: [2]i64`, emitted `LEAQ fld(SB)` — the WRONG symbol
+// (returning 9 not 7). cstage gates the probe on a NULL/ty_err inner type (a
+// module qualifier has no struct type), so a typed-struct inner resolves the
+// field off the struct. The fix gates the wwstage probe the same way; the .s is
+// byte-identical. The colliding global is read directly (global_fld_intact) so
+// the name clash is genuine; no_collide is the typed-inner control the
+// probe-skip must keep correct.
+
+package dotbase_hijack_test;
+
+type s = struct { pad: i64, fld: [2]i64 };
+type s2 = struct { pad: i64, arr: [2]i64 };
+
+let gs: s = s { pad = 0, fld = [7, 8] };
+let gs2: s2 = s2 { pad = 0, arr = [5, 6] };
+let fld: [2]i64 = [9, 10];
+
+@test fn collide_0() void = {
+	// pre-fix wwstage read fld[0] (== 9) off the colliding global.
+	assert(gs.fld[0]: i32 == 7);
+};
+
+@test fn collide_1() void = {
+	// pre-fix wwstage read fld[1] (== 10) off the colliding global.
+	assert(gs.fld[1]: i32 == 8);
+};
+
+@test fn no_collide() void = {
+	// typed-struct inner with NO name collision — the probe-skip must not
+	// break the ordinary global-struct array-field index.
+	assert(gs2.arr[0]: i32 == 5);
+};
+
+@test fn global_fld_intact() void = {
+	// the colliding global is a genuine distinct symbol, not gs.fld.
+	assert(fld[0]: i32 == 9);
+	assert(fld[1]: i32 == 10);
+};

test/lang/glob_ptr_field_test.ww

@@ -0,0 +1,26 @@
+// glob_ptr_field_test — a scalar field store through a module-GLOBAL `*struct`
+// pointer (`gp.f = v`) must load the pointer value from gp(SB), not deref the
+// saved-BP word, migrated from test/wcc/989_globptrfield_run.c (inverse-set
+// #47, report-item [58]). cstage's N_DOT-lhs via_ptr scalar store loaded the
+// base with `MOVQ boff(BP),BX`; for a module-global base boff==0, so it emitted
+// `MOVQ (BP),BX` — derefing saved BP as the pointer → store through garbage →
+// SEGV. wwstage was already correct (LEAQ gp(SB),BX; MOVQ (BX),BX); the cstage
+// half aligned UP and the .s is byte-identical, so a behavioral @test is the
+// net. backing is a fresh (zeroed) global; a store that lands in garbage never
+// writes the symbol, so a read-back of backing's field catches the miss. The
+// static-init form `let gp: *S = &backing;` is #48-blocked, so the runtime
+// `gp = &backing` form is used (as in the C twin).
+
+package glob_ptr_field_test;
+
+type S = struct { f: i64, g: i64 };
+
+let backing: S = S { f = 0, g = 0 };
+let gp: *S = nil;
+
+@test fn store_off0() void = {
+	// the exact #58 repro: field at offset 0 through the global pointer.
+	gp = &backing;
+	gp.f = 7;
+	assert(backing.f: i32 == 7);
+};

test/lang/glob_struct_ret_test.ww

@@ -0,0 +1,36 @@
+// glob_struct_ret_test — returning a module-GLOBAL struct ident by value
+// (`return g;`) must copy g's bytes into the return buffer, migrated from
+// test/wcc/989_globstructret_run.c (F8-c6, #41, #263). The ≤24B register-struct
+// return path word-copied an N_IDENT source from its BP slot only for a LOCAL
+// ident; a module-global ident hit no branch (wwstage zero-filled the @retscr,
+// cstage copied frame garbage), never g(SB). Both stages now copy g's bytes via
+// the aggregate src-addr memcpy (LEAQ g(SB),SI) and the .s is byte-identical,
+// so a behavioral @test is the net. Each field is asserted individually so a
+// dropped / mis-offset word FAILS (a zero-filled @retscr reads back 0).
+
+package glob_struct_ret_test;
+
+type point = struct { x: i64, y: i64 };
+type triple = struct { a: i64, b: i64, c: i64 };
+
+let g16: point = point { x = 3, y = 4 };
+let g24: triple = triple { a = 5, b = 6, c = 7 };
+
+fn get16() point = { return g16; };
+fn get24() triple = { return g24; };
+
+@test fn ret_16() void = {
+	// rsz 16 register-struct return of a global ident.
+	let p: point = get16();
+	assert(p.x: i32 == 3);
+	assert(p.y: i32 == 4);
+};
+
+@test fn ret_24() void = {
+	// rsz 24 register-struct return of a global ident (the third word pins
+	// the full-payload copy).
+	let p: triple = get24();
+	assert(p.a: i32 == 5);
+	assert(p.b: i32 == 6);
+	assert(p.c: i32 == 7);
+};