resolve_type for N_TTAGGED was peeling NAMED aliases to TY_VOID before
deciding the union is a nullable pointer, which caught (*T | nomem)
(nomem = !void) and routed it through cstage's ptr-in-AX shortcut.
wwstage's isnullabletype is purely AST-keyed on bare `void`, so any
alias or error-tagged void naturally fell through to the general
AX=tag, DX=word0 ABI. Rule 10 says align richer DOWN: gate the cstage
classifier on iserror==0 so only the literal (*T | void) shape still
folds to nullable-ptr. The literal void case stays intact for
700_e2e:642/661/1129.
Smoke test selfhost/test/tagged_ptr_ret.ww exercises (*u8 | nomem)
across both arms; cstage and wwstage now emit byte-identical asm
modulo the pre-existing #20 fmt.formatfield divergence.