lib/math: port math::checked (overflow + saturating arithmetic)

Port Hare's math::checked to lib/math/checked/ as a two-file module
mirroring the upstream split:
  - checked.ww   (ref/hare/math/checked/checked.ha): add*/sub*/mul*
    returning (result, overflow) with wrapping semantics — addi/addu/
    subi/subu 8-64 and muli/mulu 8-32 (22 fns).
  - saturating.ww (ref/hare/math/checked/saturating.ha): sat_* clamping
    to the type's range on overflow — sat_addi/addu/subi 8-64 and
    sat_muli/mulu 8-32 (18 fns).
checked_test.ww drives the verbatim Hare @test vectors (crash-trick
idiom) via cross-module tuple-return destructure for the overflow fns;
wrapped by test/wcc/969_checked_run.c. Both stages emit byte-identical
asm; make test-unit green.

Three ww adaptations vs Hare, all forced by language differences, none
behavioral (documented at the sites):
  - no if-as-expression -> `return if (c) X else Y` becomes if-stmt.
  - no implicit integer promotion -> the mul overflow compares use an
    explicit widening cast.
  - sub-word arithmetic truncates only on store to a typed lvalue, so
    unsigned overflow tests force the wrap through a typed `res`.

Deferred as faithful Hare-subsets (Hare splits per type; no inlining):
  - size-typed *z variants: no `size` type yet (#85).
  - int/uint native-width variants: ww int/uint are 64-bit, a silent
    overflow-boundary width divergence.
  - 64-bit muls (muli64/mulu64/powi64, sat_muli64/sat_mulu64) and the
    muli/mulu dispatchers: need math::mulu64 (128-bit product).
  - sat_subu8/16/32/64: need types::U*_MIN, not yet in lib/types.

Saturating sat_* reference the types limits at RUNTIME (conditional
return, not a const-initializer), which resolves cross-module today
(#88 is const-fold-only). subi64's I64_MAX/I64_MIN boundary @test vector
is omitted while #89 is open (its I64_MIN literal miscompiles on
wwstage); the saturating I64_MIN assertions use the types.I64_MIN
def-ref, which is byte-id clean.

test/wcc/969_checked_run.c

@@ -0,0 +1,51 @@
+/*
+ * 969_checked_run — execute the lib/math/checked @test fixture under
+ * the C-side `ww run` driver and assert exit 0.
+ *
+ * Sibling to 966_strings_run / 967_bytes_run / 968_utf8_run / 980_memio
+ * _run / 999_random_run. checked_test.ww carries its own `export fn
+ * main()` that drives the @test fns and signals which case failed via
+ * the exit code, so this file is just a thin wrapper — no @test
+ * scanning, no synthetic main generation.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return 1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+	char cwd[1024];
+	if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+
+	const char *src = "lib/math/checked/checked_test.ww";
+	char path[1024], cmd[2048];
+	snprintf(path, sizeof path, "%s/%s", cwd, src);
+	snprintf(cmd, sizeof cmd, "%s/ww run %s", bin, path);
+	int rc = runwait(cmd);
+	if (rc != 0) {
+		fprintf(stderr, "checked_run FAIL: %s exited %d\n", src, rc);
+		return 1;
+	}
+	printf("checked_run: %s ok\n", src);
+	return 0;
+}