comptime VM: harden against malformed lowering-time IR (P3.4-prep)

Prerequisite for wiring the VM at the lowering-time comptime site
(runComptimeTypeFunc), where IR can be malformed (an unresolved name lowers to a
dangling / Ref.none operand — the 0737 crash). Close the remaining panic vectors
so the VM bails (-> legacy fallback) instead of aborting:

- Vm.refTy(ref_types, r): a bounds-checked accessor replacing every raw
  ref_types[ref.index()] in exec — the type-side companion to Frame.get's
  bad_ref value-side guard.
- aggType is now a bailing method (Error!TypeId) routed through refTy.
- the block-dispatch loop bounds-checks the branch target before indexing
  func.blocks.items (a malformed br target). global_get was already guarded.

No behavior change: gate OFF and -Dcomptime-flat both 697/0. Unit test added
(a cmp_lt with a Ref.none operand bails, not panics).

src/ir/comptime_vm.test.zig

@@ -1236,6 +1236,23 @@ test "comptime_vm: a malformed operand ref (Ref.none) bails, not a panic" {
     try std.testing.expectError(error.Unsupported, v.run(&fb.func, &.{}));
 }
 
+test "comptime_vm: a malformed operand TYPE ref bails (refTy), not a panic" {
+    // A comparison whose lhs is `Ref.none` exercises the `ref_types` (type-side)
+    // accessor `refTy` — the companion to the value-side `Frame.get` guard. Raw
+    // `ref_types[Ref.none.index()]` would index out of bounds and panic; it must
+    // bail (error.Unsupported) so the host falls back to the legacy interpreter.
+    var fb = Fb.init(std.testing.allocator, &.{}, .bool);
+    defer fb.deinit();
+    const b0 = fb.block(&.{});
+    const c = fb.add(b0, inst(.{ .const_int = 1 }, .i64));
+    const r = fb.add(b0, inst(.{ .cmp_lt = .{ .lhs = Ref.none, .rhs = ref(c) } }, .bool));
+    _ = fb.add(b0, inst(.{ .ret = .{ .operand = ref(r) } }, .void));
+
+    var v = vm.Vm.init(std.testing.allocator);
+    defer v.deinit();
+    try std.testing.expectError(error.Unsupported, v.run(&fb.func, &.{}));
+}
+
 test "comptime_vm: hardened accessors return OutOfBounds, not a panic" {
     var m = vm.Machine.init(std.testing.allocator);
     defer m.deinit();