selfhost+test: graduate bare-leaf fnretlookup same-module-first (#4e)

Class A silent miscompile, latent until two modules export the same
fn leaf name with diverging return-type categories (str vs scalar,
tagged vs not, tuple vs not, float vs int, struct-payload-size).
Wwstage's fnretlookup (selfhost/cmd/wcc/cgen.ww) walked c.fnrets
head-first by fname and returned the FIRST match's rtype. cgcall's
str-shuffle decision (cgenexpr.ww:3249) handed it calleename (the
bare leaf from an N_IDENT callee); a same-leaf foo registered later
(at head) returning str then mis-fired isstrtype(c, rt) for an
i64-returning callee, emitting a spurious MOVQ DX, BX after the
CALL — the SysV (AX, DX) → ww str (AX, BX) shuffle — corrupting
BX even though the callee never returned an str pair. Every other
bare-leaf consumer (taggedcallslot, callsretsize, exprfloatkind,
rhstaggedabicall, tuple destructure in cglet/cgmlet, fn-rvalue
LEAQ in cgident, cgtry{prop,unw} success-shuffle) keys on the same
fnretlookup return and was silently miscompiling under the same
collision shape.

Cstage carries no sister bug: cmd/wcc/check.c N_CALL routes
cexpr(c, n->lhs) through scope_lookup_prefer for an N_IDENT callee,
then cmd/w6c/cgen.c reads the return type from the typed
n->lhs->type's TY_FN sig — module-aware via the typed AST,
sidestepping any bare-leaf table. cs vs ws diverged on every same-
leaf fn return-category collision but no in-tree corpus declares
two same-leaf fns with diverging return categories today: 995
stays green (same surfacing pattern as #4a enumlookup post-strings,
#4b structlookup, #4c def, #4d fnparams).

Eighth and FINAL leaf of the trio graduation (after #27 aliaslookup,
#28 fnparams *mod*-variant, #31 fnret *mod*-variant, #4a enum, #4b
struct, #4c def, #4d fnparams bare-leaf). fnretlookupmod (the N_DOT
consumer at cgen.ww:1585) already exists post-#31; this commit
graduates only the BARE-LEAF entry point with a same-module-first
walk mirroring fnparamslookup's two-pass shape (#4d). 12+ bare-leaf
callsites consume the graduated lookup uniformly — none separately
re-routed to fnretlookupmod since the in-tree N_DOT collisions
(strings.next vs utf8.next; bytes.hasprefix vs strings.hasprefix
and equivalents) all have invariant return shape across the
colliding overloads. A future stdlib port introducing a return-
category-divergent same-leaf N_DOT collision will need the *mod
re-routing — file at that surfacing.

Pre-flight on 995_self_rebuild green: rob's brief warned 1-2 byte-
id surfaces possible because bare-leaf graduation could flip
MOVQ↔MOVSXD or push-count on selfhost compile paths not routed
through *lookupmod. Audit confirms the corpus has bare-leaf same-
name fn pairs (compare in lib/strings vs lib/time; next in utf8
vs strings) but downstream consumer behavior is invariant under
both shapes — cross-module calls all go through N_DOT →
fnretlookupmod, not the bare-leaf path. Zero actual surfaces.

731_fnret_bare_leaf_shadow pins the fix with 1 row: alpha defines
fn foo() i64 + fn alphacaller() i64 = { return foo(); }, beta
defines fn foo() str declared LAST in source so beta.foo prepends
to the head of c.fnrets. alphacaller's bare foo() must compile
against alpha.foo's i64 return (no str-shuffle) even with beta.foo
at the head of c.fnrets. Asserts CALL alpha.foo inside the right
TEXT sym + bad_imm MOVQ DX, BX anti-check on each stage plus
cs-vs-ws byte-id per row.

selfhost/cmd/wcc/cgen.ww

@@ -1563,11 +1563,28 @@ fn collectfnrets(c: *cgen, file: *node) void = {
 	};
 };
 
+// fnretlookup — declared return-type node for a fn by leaf name, or nil
+// if the name isn't a registered fn. Same-module-first walk before the
+// head-walk fallback. Eighth and final leaf of the trio graduation (#4e)
+// mirroring aliaslookup (#27), fnret/fnparamslookupmod (#28/#31),
+// enum/struct/deflookup (#4a/#4b/#4c), fnparamslookup (#4d): without
+// the prefer pass a bare-leaf `foo()` call site in module M (N_IDENT
+// callee) silently picks another module's same-leaf `foo` from the
+// head of c.fnrets, then every downstream consumer keying on the
+// return type (str-pair shuffle, tagged-union ABI, tuple destructure,
+// float ABI, sret slot sizing, fn-rvalue LEAQ, slice flow) fires
+// against the wrong-module shape.
 fn fnretlookup(c: *cgen, name: str) *node = {
 	let f: *fnret = c.fnrets;
 	for (f != nil) {
-		let fn_: str = f.fname;
-		if (streq(fn_, name)) { return f.rtype; };
+		if (streq(f.fname, name)) {
+			if (streq(f.fmod, c.curmod)) { return f.rtype; };
+		};
+		f = f.frnext;
+	};
+	f = c.fnrets;
+	for (f != nil) {
+		if (streq(f.fname, name)) { return f.rtype; };
 		f = f.frnext;
 	};
 	return nil;