w6c: forrange bind cap loud; drain widen gates keyed on type-eq (#55)

Two silent seams in one sweep. The for-range destructure silently
dropped the 9th+ binding in both stages (bind arrays are sized 8);
the cap now hard-stops per the DEFER_MAX/LOOP_MAX discipline (the
shape is unreachable today -- every wide-tuple construction path
already loud-stops). argtaggedwidensz, the drain-side SSoT for
widened call args, still keyed "natural push" on slot-size equality
while pushargsrev flipped to type equality with #55 -- a same-slot
subset was classified widen by push, natural by drain (counts
coincide today; a classification reader desyncs, the #48 shape).
Both sides now share the wsame key; the widen-branch tag miss for a
concrete source joins the task-2 loud-stop family (tagged subset
sources keep t=0 -- their widentag is never read, the scratch store
remaps).

Lead 17 (enum fold-failure prev+1) DISPROVED: enumvalfold gates
every member init in the checker and its fold set is op-for-op
equal to cgen's enumevalmember, so the fallback only runs inside
already-failing compiles.

cmd/w6c/cgen.c

@@ -15209,7 +15209,13 @@ cgstmt(Cg *c, Node *n, Local **locals, int *frame)
 			Tparam *tp = (etu && etu->kind == TY_TUPLE) ?
 			    etu->params : NULL;
 			int field_off = 0;
-			for (Node *nm = n->list; nm && nbinds < 8; nm = nm->next) {
+			for (Node *nm = n->list; nm; nm = nm->next) {
+				/* binds[] is sized 8; a 9th binding silently
+				 * vanished pre-gate (rule 7 — the DEFER_MAX/
+				 * LOOP_MAX cap discipline). */
+				if (nbinds >= 8)
+					fatal("for-range destructure: more "
+					    "than 8 bindings (rule 7)");
 				int fsz = tp && tp->type ? (int)tp->type->size : 8;
 				int slot_sz = (fsz < 8) ? 8 : fsz;
 				binds[nbinds].sz = fsz;