ffi issue-0048: lazyLowerFunction isolates pack-fn mono state

`lazyLowerFunction` now saves and nulls `pack_arg_nodes`,
`pack_param_count`, `pack_arg_types`, and `inline_return_target`
before lowering the callee's body, then restores them via defer.

Same shape as the save/restore already in `createComptimeFunction`
(issue-0046 fix). Without this, a lazily lowered regular fn called
from inside a pack-fn mono inherited the outer pack maps, and the
`<pack_name>.len` intercept in `lowerFieldAccess` constant-folded
the callee's same-named param to the outer mono's arity.

`examples/173-pack-bare-args-cross-call.sx` now passes; previously-
green tests untouched. 213/213.

current/CHECKPOINT-FFI.md

@@ -852,7 +852,19 @@ plus 2 codegen fixes surfaced along the way.**
 
 ## Current state
 
-- 212/212 example tests pass; `zig build test` green.
+- 213/213 example tests pass; `zig build test` green.
+- issue-0048 (bare `$args` slice loses `.len` across function-
+  call boundary — root cause: `lazyLowerFunction` did not save/
+  restore `pack_arg_nodes` / `pack_param_count` / `pack_arg_types`
+  / `inline_return_target`, so a lazily lowered callee inside a
+  pack-fn mono inherited the outer pack maps and `lowerFieldAccess`'s
+  `<pack_name>.len` intercept folded the callee's same-named param
+  to the outer mono's arity). FIXED — defer-restore block added to
+  `lazyLowerFunction`; regression locked in at
+  `examples/173-pack-bare-args-cross-call.sx`.
+- Step 5.0 probe done — nested `() -> Ret callconv(.c) { body }`
+  parses, `@inner` address-of binds to a fn-pointer, indirect call
+  works. The trampoline emission pattern is unblocked.
 - Phase 3.0/3.1/3.2 + M1.0–M1.3 + M2.1–M2.3 + M3 + M4.0 + M4.A all landed.
 - Pack feature step 1 done (1c.A → 1d.B; commits bb6eca6 → 08feb60).
 - Pack feature step 2 done — typed `args[$i]` at literal indices