lang: introduce cstring — the C-boundary string (Odin model)

cstring is ONE pointer to a null-terminated u8 buffer, C's char*: thin
(8 bytes, no length; cstring_len walks to the terminator), crossing
#foreign boundaries verbatim in both directions, with ?cstring as the
nullable case lowering to the same bare pointer (null = absent).

Conversion discipline mirrors Odin: a string LITERAL coerces implicitly
(its bytes are terminated constants); any other string is rejected with
a diagnostic naming to_cstring (it may be an unterminated view); and
cstring never coerces to string implicitly — from_cstring(c) is the
explicit zero-copy view, pricing the strlen.

Plumbing: TypeId/TypeInfo builtin slot 18 (first_user 19), name
classifiers, size/align/name tables, LLVM ptr lowering, the ?T pointer
niche, the xx pointer ladder, the literal-gated coercion plan
(isConstString + data_ptr), and the reserved-spelling set. std gains
cstring_len/from_cstring/to_cstring (fmt.sx, re-exported); the old
cstring(size) allocator helper is renamed alloc_string everywhere;
getenv migrates to (name: cstring) -> ?cstring as the canonical user
and env() drops its manual strlen/memcpy.

Pinned: examples/1222 (FFI both directions, literal coercion,
?cstring null paths, round trip) and examples/1173 (both coercion
diagnostics); FAIL pre-feature. The alloc_string rename + getenv
signature shift the .ir snapshots — regenerated. zig build test
426/426; run_examples 604/604.

Spec: reserved spelling + cstring section + C-interop rows.

library/modules/std/fs.sx

@@ -130,7 +130,7 @@ read_file :: (path: [:0]u8) -> ?string {
     size := lseek(fd, 0, SEEK_END);
     if size < 0 { close(fd); return null; }
     lseek(fd, 0, SEEK_SET);
-    buf := cstring(size);
+    buf := alloc_string(size);
     n := read(fd, buf.ptr, xx size);
     close(fd);
     if cast(i64) n != size { return null; }
@@ -191,7 +191,7 @@ create_dir_all :: (path: [:0]u8) -> bool {
         last -= 1;
     }
     if last > 0 {
-        parent := cstring(last);
+        parent := alloc_string(last);
         memcpy(parent.ptr, path.ptr, last);
         if !create_dir_all(parent) { return false; }
     }
@@ -211,7 +211,7 @@ copy_file :: (src: [:0]u8, dst: [:0]u8) -> bool {
         return false;
     }
     ok := true;
-    buf := cstring(65536);
+    buf := alloc_string(65536);
     loop := true;
     while loop {
         n := read(src_fd, buf.ptr, 65536);