cstage+selfhost+test: wire sret return-forwarding (#9)

Class A compile-time fatal retirement — `return f()` from an sret
callee bailed both stages with "sret return-forwarding for >24B
struct not wired (task #23)" at every site, forcing every caller
into a `let r = f(); return r;` workaround that materialised an
intermediate >24B copy in outer's frame. Forwarding now elides the
copy: outer reloads its own @sretarg into RDI for the inner CALL
via `MOVQ @sretarg(BP), DI` (NOT `LEAQ <local>, DI`), inner writes
directly into outer's caller-prealloc dest, RAX (inner's returned
dest pointer per the sret discipline) is already outer's return
value.

Wires 2 sites × 2 stages (same triangle as #23): caller arg-shift
in cgcall/pushargsrev gains an RDI-source switch via
cg_sret_forward / c.sretforward; callee return-arm in cgreturn
replaces the fail-loud abort with cgexpr-into-cgcall + epilogue.
The @sretscr scratch slot is still pre-allocated on the forwarding
branch (unused) — eliding would need AST-walk awareness in
scanlocals; symmetric-allocate is the simpler path and keeps
byte-id with non-forwarding callers.

Latent surfaced and filed during probe (NOT in this commit's
scope): multi-sret-receive in a single fn diverges between stages
— cstage always allocates @sretscr on first sret CALL, wwstage
only when sretdestoff == 0. Bootstrap stays green because the
selfhost corpus has zero >1-sret-receive call sites.

Tests:
  - 721_sret_struct_return gains 2 forwarding rows + a 4th asm-
    presence sentinel: at the inner CALL site inside outer fn, the
    RDI source must be `MOVQ -K(BP), DI` (reload of outer's saved
    @sretarg) NOT `LEAQ -K(BP), DI` (a temporary local would write
    inner's payload into outer's frame, not caller's dest).
  - 925_sret_struct_return_run gains 3 forwarding rows: simple
    quad forward, multi-arg inner (pair-by-value + scalar args
    alongside the hidden RDI), and slice-payload (decoder
    { i64, []u8 } — the utf8 iterator shape, asserts ptr/len/cap
    survive the @sretarg chain).

90/90 ok. 995_self_rebuild stays green (ww2==ww3==ww4 byte-id).

selfhost/cmd/wcc/cgen.ww

@@ -450,10 +450,17 @@ type cgen = struct {
 	//               sums c.sretscrsz to pre-reserve.
 	// sretscrsz   — max sret discard size in this fn (sums during
 	//               scanlocals, consumed by localadd("@sretscr", ...)).
+	// sretforward — set by cgreturn `return f();` from an sret callee to
+	//               signal cgcall: source RDI for inner from outer's
+	//               saved @sretarg (MOVQ) instead of LEAQ'ing a local
+	//               dest. Inner writes into outer's caller-prealloc;
+	//               inner's RAX (the dest pointer) is already outer's
+	//               return value. Cleared after cgcall consumes it.
 	sretargoff: i32,
 	sretdestoff: i32,
 	sretscroff: i32,
 	sretscrsz: i32,
+	sretforward: i32,
 };
 
 // Top-level mutable `let` registry. Mirrors cmd/w6c/cgen.c LetVar.
@@ -481,6 +488,7 @@ fn cgeninit(c: *cgen, a: *arena) void = {
 	c.sretdestoff = 0;
 	c.sretscroff = 0;
 	c.sretscrsz = 0;
+	c.sretforward = 0;
 	// Note: strlit_seq, strlits, ffis are *not* reset here; they
 	// persist across cgfn calls within one file. cgfile resets them
 	// at the start of each compilation unit.