w6c_ww: cgtypetest nullable is discriminates pointer-vs-null (#45 review)

The #45 non-ident arm tag-compared the word in AX against the variant
index; for the nullable (*T | void) fold that word IS the pointer —
`h.m is *t` on a non-null pointer answered FALSE (silent cs≠ww,
cstage correct: CMPQ $0 + JE/JNE polarity per cgen.c N_TYPETEST).
The ident path had the same missing nullable arm since before #45
(pre-existing at master, unexercised in the bootstrap corpus). One
nullable branch at the shared compare choke-point closes both halves:
want stays RAW (cstage tests tag == ptr_tag unclamped, a no-match -1
takes the void polarity). Rows nullable_dot_field + nullable_ident
pin both polarities and both states in 927; whole-corpus control
(5 selfhost combined.ww, master-vs-branch w6c + w6c_ww) byte-id.

test/wcc/927_is_nonident_run.c

@@ -14,8 +14,12 @@
  *
  * Rows pin every scrutinee shape: indexed (constant and len-1 index),
  * dot-field, call-result, the `is []T` slice-variant axis on an
- * indexed scrutinee, and the ident control (asm hand-checked
- * unchanged vs the pre-#45 compiler when the fix landed). Per row:
+ * indexed scrutinee, the nullable `(*T | void)` pointer-vs-null
+ * discriminator on both ident and non-ident scrutinees (review
+ * finding: the first non-ident arm tag-compared the pointer; the
+ * ident half was missing the nullable arm since before #45), and the
+ * ident control (asm hand-checked unchanged vs the pre-#45 compiler
+ * when the fix landed). Per row:
  * w6c vs w6c_ww byte-id (rule 10 — cstage is the runtime-correct
  * reference shape) + runtime via both the ww and ww_ww drivers.
  */
@@ -117,6 +121,45 @@ static const struct row rows[] = {
 	  "    return 0;\n"
 	  "};\n",
 	  0 },
+	/* Nullable `(*T | void)` fold on a NON-IDENT scrutinee: the
+	 * discriminator is pointer-vs-null, not tag-vs-index (cstage
+	 * N_TYPETEST nullable arm emits CMPQ $0 + JE/JNE polarity).
+	 * Surfaced in #45 review: the first non-ident arm compared the
+	 * pointer against the variant index — `h.m is *t` on a non-null
+	 * pointer answered FALSE (silent cs≠ww, wwstage exit 1). Both
+	 * polarities, both states (ptr and void). */
+	{ "nullable_dot_field",
+	  "type t = struct { a: i64 };\n"
+	  "type maybe = (*t | void);\n"
+	  "type holder = struct { m: maybe, k: i64 };\n"
+	  "export fn main() i32 = {\n"
+	  "    let v: t = t { a = 5 };\n"
+	  "    let h: holder = holder { m = &v, k = 1 };\n"
+	  "    if (!(h.m is *t)) { return 1; };\n"
+	  "    if (h.m is void) { return 2; };\n"
+	  "    let h2: holder = holder { m = void, k = 2 };\n"
+	  "    if (h2.m is *t) { return 3; };\n"
+	  "    if (!(h2.m is void)) { return 4; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+	/* Nullable IDENT scrutinee: the same missing nullable arm hit
+	 * the ident path too (pre-existing at master, closed by the same
+	 * shared compare choke-point). */
+	{ "nullable_ident",
+	  "type t = struct { a: i64 };\n"
+	  "type maybe = (*t | void);\n"
+	  "export fn main() i32 = {\n"
+	  "    let v: t = t { a = 5 };\n"
+	  "    let m: maybe = &v;\n"
+	  "    if (!(m is *t)) { return 1; };\n"
+	  "    if (m is void) { return 2; };\n"
+	  "    let m2: maybe = void;\n"
+	  "    if (m2 is *t) { return 3; };\n"
+	  "    if (!(m2 is void)) { return 4; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
 	/* Ident control: the pre-existing slot-load path must be
 	 * untouched (also hand-cmp'd vs the pre-#45 w6c_ww). */
 	{ "ident_control",