lang: for-loop by-ref element capture (for xs: (*x))

(*x) binds x to a pointer into the collection (index_gep) instead of a per-element value copy: passing it on (e.g. to a *T param) is zero-copy and mutations write back. In a value position x auto-derefs — a binary-op operand loads the element, a pointer-typed slot keeps the pointer, and an 'if x == {...}' match derefs the pointee for its tag/payload. Arrays GEP through their storage so writes hit the original. Regression test: examples/for-by-ref-capture.sx.

src/ast.zig

@@ -492,6 +492,9 @@ pub const ForExpr = struct {
     range_end: ?*Node = null,
     /// `inline for` — comptime-unrolled (range bounds must be comptime).
     is_inline: bool = false,
+    /// `for xs: (*x)` — bind `x` to a pointer into the collection (no per-element
+    /// copy) rather than a value copy of each element.
+    capture_by_ref: bool = false,
 };
 
 pub const SpreadExpr = struct {