Give closure calls the same ABI as direct calls

[wtholliday]

Fixes #44.

Problem

The direct-call paths in src/stack_codegen.rs and src/vm_codegen.rs allocate an output slot for pointer-returned types, pass its address as an extra first argument, and push that address as the call's result. They also coerce &T params to addresses (translate_lvalue) and wrap sized arrays as slices.

The CallClosure paths did none of that. A closure or function pointer returning a struct passed one argument too few and consumed a result that was never produced:

struct P { x: i32, y: i32 }
mk(a: i32) -> P { var p: P; p.x = a; p.y = a * 2; p }
main { var g = mk; var p = g(3); assert(p.x == 3) }

backend	before	after
jit	ok	ok
asm	segfault (139)	ok
stack	segfault (139)	ok
vm	panic src/vm.rs:1290, "attempt to subtract with overflow"	ok

Fix

Fold both CallClosure sites in each backend into a single translate_closure_call that mirrors the direct-call ABI:

• sret output pointer as the extra first argument when returns_via_pointer(ret_ty), with the arg count bumped and the output storage's address used as the call's result (sret callees return void, so the float/void bridging only applies on the non-sret path);
• Reference params passed by address;
• sized arrays wrapped as slices where the callee expects one.

Callee param types come from the solved Type::Func domain of the function expression.

Also: f32x4 returns in the VM backend

vm_codegen's returns_via_pointer was missing Type::Float32x4, so f32x4 returns used a "return the address of the callee's frame slot in r0, caller memcpys after the frame pops" convention. Direct calls survived that by luck; closure calls read zeros on both vm and asm. Adding Float32x4 puts it on sret like every other pointer-represented type, matching what the stack backend already did.

Tests

New golden tests, run against all four backends:

• tests/cases/lambdas/closure_abi.lyte — struct, array, and tuple returns through a function pointer, a function-typed parameter, and a lambda; &i32 param; sized array coerced to a slice param.
• tests/cases/simd/f32x4_closure_return.lyte — f32x4 returned through a function pointer and a function-typed parameter.

cargo test --workspace passes: 380 lib tests plus golden_tests_jit / golden_tests_vm / golden_tests_asm / golden_tests_stack. cargo fmt --check diff count is unchanged (all pre-existing, in files this PR doesn't touch).

🤖 Generated with Claude Code

https://claude.ai/code/session_01DeNzkFkzMbdH3XPzitDmVa