ffi 0.5: string + byte-pointer baseline through #foreign

92/92 regression tests pass (+ffi-05-string-args).

Covers the four shapes that actually appear at the sx ↔ C boundary
today:

  1. [:0]u8 string literal -> const char*  (ffi_strlen, ffi_first_byte)
  2. sx `string` value via .ptr            (slice-decay branch in
                                            coerceArg pulls the pointer)
  3. [*]u8 raw buffer + length             (ffi_sum_bytes, mutated via
                                            ffi_write_byte and read back)
  4. C-returned const char*                (round-trips back as [*]u8)

The mutate-via-C path catches any pointer-aliasing regression — sx
allocates the fixed array `bytes : [4]u8`, passes `.ptr` to C which
writes index 1, and the sx side reads `bytes[1]` to confirm the
mutation took effect through the same memory.

vendors/ffi_strings/ffi_strings.c

@@ -0,0 +1,25 @@
+#include "ffi_strings.h"
+
+int ffi_strlen(const char *s) {
+    int n = 0;
+    while (s[n] != 0) n++;
+    return n;
+}
+
+int ffi_first_byte(const char *s) {
+    return (int)(unsigned char)s[0];
+}
+
+int ffi_sum_bytes(const unsigned char *buf, int len) {
+    int total = 0;
+    for (int i = 0; i < len; i++) total += buf[i];
+    return total;
+}
+
+void ffi_write_byte(unsigned char *buf, int idx, unsigned char val) {
+    buf[idx] = val;
+}
+
+const char* ffi_static_greeting(void) {
+    return "hello from C";
+}