ffi 0.5: string + byte-pointer baseline through #foreign

92/92 regression tests pass (+ffi-05-string-args).

Covers the four shapes that actually appear at the sx ↔ C boundary
today:

  1. [:0]u8 string literal -> const char*  (ffi_strlen, ffi_first_byte)
  2. sx `string` value via .ptr            (slice-decay branch in
                                            coerceArg pulls the pointer)
  3. [*]u8 raw buffer + length             (ffi_sum_bytes, mutated via
                                            ffi_write_byte and read back)
  4. C-returned const char*                (round-trips back as [*]u8)

The mutate-via-C path catches any pointer-aliasing regression — sx
allocates the fixed array `bytes : [4]u8`, passes `.ptr` to C which
writes index 1, and the sx side reads `bytes[1]` to confirm the
mutation took effect through the same memory.

tests/expected/ffi-05-string-args.exit

@@ -0,0 +1 @@
+0

tests/expected/ffi-05-string-args.txt

@@ -0,0 +1,7 @@
+strlen("hello")     = 5
+first_byte           = 104
+strlen(sx string)    = 14
+sum_bytes([10,20,30,40]) = 100
+bytes[1] after write = 99
+static greeting len  = 12
+static greeting [0]  = 104