docs(spec): split range bounds from counts; pin inline-for range semantics (0083)

specs.md lumped `inline for` / `for` range bounds in with counts (array
dimension, Vector lane count, generic value-param count) under the
count negative-rejection rule. A range bound is a range ENDPOINT, not a
count: negative endpoints are valid and an empty/inverted range runs zero
iterations. The compiler already implements this correctly (Agra ruling:
spec-text bug, no code change).

- specs.md: counts and range bounds are now described separately. Counts
  reject negatives; bounds accept any compile-time integer (negatives
  valid, integral floats fold) but still reject a non-integral float
  because the loop cursor must be an integer.
- examples/0612-comptime-inline-for-range-bounds.sx: `inline for -2..1`
  and `for -2..1` both sum -3; `inline for 0..(-2.0)` runs zero
  iterations (empty range). Runtime/comptime parity asserted.
- examples/1138-diagnostics-inline-for-non-integral-bound.sx: a
  non-integral float bound `inline for 0..4.5` is a clean diagnostic,
  exit 1 (must-be-integer still applies to bounds).

Count consumers (1132/1133/1134/1135) unchanged and green.

specs.md

@@ -651,11 +651,20 @@ Arrays can also be constructed programmatically with the `Array` builtin:
 MyArr :: Array(5, s32);   // equivalent to [5]s32
 ```
 
-An array dimension — and likewise a `Vector` lane count, a generic value-param
-count, and an `inline for` bound — accepts any compile-time numeric constant
-whose value is a positive integral number. An integral float (`4.0`, or a
-float-typed const `N : f64 : 4.0`) folds to its integer (`[4.0]s64` ≡ `[4]s64`);
-a non-integral float (`4.5`) or a negative value is rejected.
+A **count** — an array dimension, a `Vector` lane count, or a generic
+value-param count — accepts any compile-time numeric constant whose value is a
+positive integral number. An integral float (`4.0`, or a float-typed const
+`N : f64 : 4.0`) folds to its integer (`[4.0]s64` ≡ `[4]s64`); a non-integral
+float (`4.5`) or a negative value is rejected.
+
+A **range bound** — the start/end of an `inline for` or `for` range — is a
+range *endpoint*, not a count, so the count rules above do not apply. A bound
+accepts any compile-time **integer**, including a negative one; an integral
+float (`-2.0`) folds to its integer. A non-integral float (`4.5`) is still
+rejected, because the loop cursor must be a compile-time integer. Negative
+endpoints are valid: `inline for -2..1` iterates `-2, -1, 0`. An empty or
+inverted range (start ≥ end, e.g. `0..(-2.0)`) simply runs zero iterations
+rather than being an error.
 
 ### Slice Types
 A slice `[]T` is a fat pointer `{ptr, i64}` referencing a contiguous sequence of `T` elements. Same runtime layout as `string`.