w6c+wwstage: receive over-cap tuple sret returns at the call site (#10 Fold B)

Fold A made the CALLEE emit an over-capacity tuple return (> 4 GP or > 2
SSE eightbytes) via sret, but every receive site stayed loud-stopped, so
such a fn was not yet usefully callable. Fold B wires the call/receive end
by aligning every receive gate UP to the shared cg_sret_retsize() /
callsretsize() > 0 predicate (never a kind), per Rob's (B) ruling:

  - single-var-let  `let t = f();`      cstage gate generalised from
        TY_STRUCT&&>24 to cg_sret_retsize(lt)>0; the let's slot IS the
        sret dest, the callee writes the whole tuple there, t.0/t.1 read
        by offset. wwstage already keyed callsretsize (verified).
  - N_ASSIGN-ident  `t = f();`          same generalisation; global arm
        kept TY_STRUCT-only (a tuple-global has no sret-to-symbol path in
        either stage). wwstage grows a tuple-local arm (rettupleof gates
        it apart from the >24B-struct recv, which keeps its own path).
  - destructure     `let (a,b) = f();` and `a,b = f();` — the genuinely
        new wiring: the callee sret's into the @sretscr discard slot, then
        a copy-out loop moves each element to its binding at the SAME
        packed offset the SEND wrote (foff += element size), each at its
        natural width (#169); a `_` binding skips its store but advances
        foff. Both stages, byte-identical.
  - return-forward  `return f();`        cstage forward gate generalised
        to the predicate, reusing cg_sret_forward verbatim. wwstage
        already keyed sretretsize (verified).

The escape boundary stays loud: arg-pass `g(f())` fatals identically in
both stages (tuple arg exceeds return-cursor ABI capacity).

Test 799 is the runtime net Fold A deferred (byte-id is blind to a
SEND/RECEIVE layout mismatch): the bytes.cut-shaped ([]u8,[]u8) round-trip
over destructure / single-var-let / reassign / return-forward, each both
RUN under cstage and asserted cs==ww byte-identical. Tests 945 (row F)
and 956 (f64x3) flip from asserting the old over-cap loud-stop to
asserting the now-working sret round-trip. combined.ww amalgams (w6c +
wwdump embed the wcc cgen) regenerated. Unblocks #4 bytes.cut/rcut.

test/wcc/945_tuple_nary_destructure_run.c

@@ -48,8 +48,11 @@
  *   G  massign_blank_wide  `_, a = f()`, f()->([]u8,i64). The blank `_`
  *                    rides a 3-word slot so a lands on R8 (the i64), not DX
  *                    (slice.len). len=2,cap=5,i64=7 distinct (any desync !=7).
- *   F  slice_slice_builderr  f()->([]u8,[]u8) returns (a,b) — 6 eightbytes,
- *                    the build MUST FAIL (loud stop) on both stages.
+ *   F  slice_slice_recv  f()->([]u8,[]u8) returns (a,b) — 6 eightbytes >
+ *                    cap; the SEND sret's it (#10 Fold A) and the
+ *                    destructure RECEIVE copies all 3 words/element out
+ *                    of @sretscr (#10 Fold B). len AND cap of both halves
+ *                    asserted (cap!=len) so a dropped word is caught.
  *
  * Fold discriminators: A/B (slice) — the old str-only XOR was slice-blind,
  * so the slice fell to the scalar-pair fallback and dropped len/cap; B's
@@ -57,9 +60,11 @@
  * receive width from the binding type, which is null for an unstamped `_`,
  * so a wide `_` was mis-sized scalar and the cursor desynced (cstage read
  * DX, wwstage R8); deriving width from the rhs tuple type fixes + aligns
- * both stages. F (loud stop) — the old code register-returned ([]u8,[]u8)
- * with only the two .ptr words (built + ran WRONG); the fix turns that into
- * a BUILDERR. C/D/E are CONTROLS: the (i64,str) path was ALREADY 3-word
+ * both stages. F (over-cap recv) — the pre-#10 code register-returned
+ * ([]u8,[]u8) with only the two .ptr words (built + ran WRONG); #10 Fold A
+ * loud-stopped it at the SEND, and Fold B now sret's + copies it out into
+ * the bindings, so it is a working round-trip (was a BUILDERR at Fold A).
+ * C/D/E are CONTROLS: the (i64,str) path was ALREADY 3-word
  * under the old XOR, and the single-str return is a separate untouched
  * branch — they confirm no regression. All 14
  * fixtures pass on both the cstage `ww` and wwstage `ww_ww` drivers with
@@ -201,22 +206,27 @@ static const struct row rows[] = {
 	  "    return 0;\n"
 	  "};\n",
 	  0, 0, NULL },
-	/* F — slice_slice_builderr: ([]u8,[]u8) = 6 eightbytes > 4 capacity.
-	 * The send site MUST loud-stop (return-ABI #10); the build FAILS on
-	 * both stages WITH the cited diagnostic (builderr=1: pass iff build
-	 * returns nonzero AND stderr carries experr — rule 7, loud not silent). */
-	{ "slice_slice_builderr",
+	/* F — slice_slice_recv: ([]u8,[]u8) = 6 eightbytes > 4 capacity. The
+	 * SEND sret's the over-cap tuple (#10 Fold A) and the destructure
+	 * RECEIVE copies all 3 words per element out of the @sretscr slot
+	 * (#10 Fold B) — formerly a loud-stop, now a working round-trip.
+	 * Asserts BOTH len AND cap of each half (cap != len) so a dropped
+	 * word — the original register-return bug — is caught at runtime. */
+	{ "slice_slice_recv",
 	  "fn mk() ([]u8, []u8) = {\n"
-	  "    let a: []u8; a.len = 1; a.cap = 1;\n"
-	  "    let b: []u8; b.len = 2; b.cap = 2;\n"
+	  "    let a: []u8; a.len = 1; a.cap = 5;\n"
+	  "    let b: []u8; b.len = 2; b.cap = 6;\n"
 	  "    return (a, b);\n"
 	  "};\n"
 	  "export fn main() i32 = {\n"
 	  "    let (x, y) = mk();\n"
-	  "    if (x.len: i32 != 1)   { return 1; };\n"
+	  "    if (x.len: i32 != 1) { return 1; };\n"
+	  "    if (x.cap: i32 != 5) { return 2; };\n"
+	  "    if (y.len: i32 != 2) { return 3; };\n"
+	  "    if (y.cap: i32 != 6) { return 4; };\n"
 	  "    return 0;\n"
 	  "};\n",
-	  0, 1, "register-return ABI capacity" },
+	  0, 0, NULL },
 };
 
 static int