wwstage: C-FFI variadic call codegen parity with cstage (#10)

Mirror cstage's C-variadic call handling in the ww self-host: parse a
bare `...` param (decl.ww), skip param-keyed desugar for it to avoid a
nil-deref (check.ww), and emit AL = XMM-reg count plus CVTSS2SD
promotion of f32 args in the variadic tail (cgenutil.ww, cgenexpr.ww).
Closes the cat-A wwstage silent miscompile (AL=0, unpromoted f32 tail).

Parse/check/cgen are one atomic align-up (parse alone miscompiles, so
not bisect-splittable). 989_ffivariadic now runs dual-stage (cstage ww
+ wwstage ww_ww), 12/12; w6c==w6c_ww byte-identical. Byte-id alone is
blind here (the bootstrap calls no float-bearing C variadic), so the
ww_ww runtime rows are the real net.

Makefile

@@ -835,8 +835,9 @@ $(BIN)/test_idxarg_run: test/wcc/989_idxarg_run.c \
 # fixture is built self-contained (zero relocs + zero undef syms, verified via
 # readelf -r / nm) so w6l links it with no libc, then wrapped in libffifix.a
 # under $(OUT)/ffivariadic (the harness finds it via $(BIN)/../ffivariadic).
-# cstage `ww` ONLY — wwstage AL is C2. Fixture flags are fixed (NOT $(CFLAGS),
-# which is -O0/-std=c99) to match ken's verified self-contained build.
+# Runs on BOTH cstage `ww` and wwstage `ww_ww` (C2). Fixture flags are fixed
+# (NOT $(CFLAGS), which is -O0/-std=c99) to match ken's verified
+# self-contained build.
 $(OUT)/ffivariadic/libffifix.a: test/wcc/data/ffivariadic/fixture.c
 	@mkdir -p $(OUT)/ffivariadic
 	$(CC) -O1 -fno-stack-protector -fno-asynchronous-unwind-tables \
@@ -845,7 +846,9 @@ $(OUT)/ffivariadic/libffifix.a: test/wcc/data/ffivariadic/fixture.c
 
 $(BIN)/test_ffivariadic_run: test/wcc/989_ffivariadic_run.c \
 		$(OUT)/ffivariadic/libffifix.a \
-		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<