cmd/w6c+selfhost/wcc: route cgparam/MLET/spill sizes through SSoT

#43 (8e93b31 + 087c85c) routed many sizeof(str) / sizeof(slice)
sites through primtypesize / tyslicesize / ty_*->size, but missed
the cgparam regs-fit, cgparam stack-stitch, cgmlet mixed
scalar+str receive, and vararg slice gather paths in both stages.
A bare #1 bump (str→24B) on top of #43 reds ~60 tests because
those paths still hardcoded 16/24.

Cstage:
- cgen.c:7360-7361 cgmlet: sz0/sz1 → (int)u0->size / (int)u1->size.
- cgen.c:7557 cgparam regs-fit: slice|is_str → (int)pu->size.
- cgen.c:7586 cgparam stack-stitch: same.
- cgen.c:4368 cgcall vararg gather: localoff slice descriptor →
  (int)vsu->size (the cstage twin of cgenexpr.ww:3084).

Wwstage:
- cgendecl.ww:225, :243 cgfnparams: 16 → primtypesize("str"): i32.
- cgenexpr.ww:3084 cgcall vararg gather: 24 → tyslicesize(): i32.

Plus a latent-bug fix at cgenstmt.ww cglet :1031 / :1040: the
str-init and slice-init arms dispatched on size only. Under #1's
str→24, both arms would have fired on a str let (duplicate
MOVQ BX,off+8 + bogus MOVQ CX,off+8). Added isstrtype / isslicetype
kind gates mirroring cstage cgen.c:6439's
`type_isstr(lt) && sz == ty_str->size`. Zero asm change today
because the size constants implicitly disambiguate at 16 vs 24.

Probe with temporary #1 bump (str.size=24) confirms 990_selfhost +
994_w6c_ww go green — the cgen-routing slice for #1 is now
closed. Remaining red under bump is lib/ww/typ.ww's parallel SSoT
seed + stringstest cap*16u64 strides + w6l_ww runtime SIGSEGV;
all tracked separately.

EIGHTBYTES register-count sites (cgen.c:7553-7554, cgendecl.ww:224
/:260) intentionally NOT touched — those are str ABI in-flight
3-reg work (task #34), not slot-width SSoT.

selfhost/cmd/wcc/cgendecl.ww

@@ -222,7 +222,11 @@ fn cgfnparams(c: *cgen, params: *node) void = {
 				};};
 			} else { if (isstrtype(c, p.lhs)) {
 				if (idx + 2 <= 6) {
-					let off: i32 = localadd(c, nm, 16, p.lhs);
+					// #60: route str-param slot width through the
+					// primtypesize SSoT so #1's ty_str bump propagates
+					// here (parent #43 covered the reg-fill site only
+					// inside cgexpr).
+					let off: i32 = localadd(c, nm, primtypesize("str"): i32, p.lhs);
 					emitline("\tMOVQ\t");
 					emitline(argregname(idx));
 					emitline(", ");
@@ -240,7 +244,8 @@ fn cgfnparams(c: *cgen, params: *node) void = {
 					// 440-469. Only idx=5 hits this (nw=2,
 					// regs_left=1): ptr lands in R9, len at
 					// +16+stkcursor*8(BP).
-					let off: i32 = localadd(c, nm, 16, p.lhs);
+					// #60: same SSoT routing as the regs-fit arm above.
+					let off: i32 = localadd(c, nm, primtypesize("str"): i32, p.lhs);
 					let regs_left: i32 = 6 - idx;
 					let w: i32 = 0;
 					for (w < regs_left) {