ffi 0.6: C-to-sx callback baseline (1-arg + ctx-ptr forms)

93/93 regression tests pass (+ffi-06-callback).

Mirrors the `app->onInputEvent` install pattern from
library/modules/platform/android.sx:

  1. (s32) -> s32              — single primitive arg/return
  2. (*void, s32) -> s32       — opaque ctx pointer + value
                                  (the onInputEvent shape)

Side effects via two file-level globals so the test observes both
the return value AND state mutation across multiple calls:
- g_callback_hits = N proves the callback fired N times.
- g_callback_sum  = sum of args proves each individual call landed
  with the correct value.

The ctx-pointer variant casts `*void` back to `*s32` inside the
callback and reads through it (`p.*`), proving the pointer survives
the round-trip with no aliasing weirdness.

tests/expected/ffi-06-callback.exit

@@ -0,0 +1 @@
+0

tests/expected/ffi-06-callback.txt

@@ -0,0 +1,7 @@
+callback returned        = 42
+hits after first call    = 1
+sum after first call     = 21
+hits after three calls   = 3
+sum after three calls    = 39
+ctx + value              = 142
+hits after ctx callback  = 4