fix: gate implicit optional unwrap on flow narrowing (issue 0179)

Optional (?T) operands were implicitly unwrapped without proof of
presence, silently miscompiling a NULL ?T to garbage. Unwraps in
binary ops and other expression positions are now gated on flow
narrowing: a ?T value is only auto-unwrapped where control flow has
established it is non-null (the narrowed_refs set). Outside a narrowed
region, an implicit unwrap is rejected rather than producing garbage.

Touches the lowering pipeline (lower.zig + lower/{call,closure,coerce,
comptime,control_flow,expr,ffi,generic,pack,stmt}.zig). Adds optionals
examples 0919-0923 and closures example 0312 covering flow narrowing,
binop narrowing, no-implicit-unwrap rejection, and no closure leak of
narrowed state. Updates specs.md and readme.md.

examples/closures/expected/0312-closure-optional-param-arg-coercion.exit

@@ -0,0 +1 @@
+0

examples/closures/expected/0312-closure-optional-param-arg-coercion.stderr

@@ -0,0 +1 @@
+

examples/closures/expected/0312-closure-optional-param-arg-coercion.stdout

@@ -0,0 +1,6 @@
+pick 7: 7
+pick null: -1
+h 5: 5
+h null: -1
+fp 8: 8
+fp null: -1