ERR/E1.7: onfail — cleanup on error-exit, interleaved with defer

`onfail [e] BODY` runs cleanup only when an error LEAVES the enclosing block
(a `raise` or a propagating `try`), and is skipped on success — unlike `defer`,
which runs on every exit. On an error exit, defers and onfails run interleaved
in reverse declaration order; `onfail e` binds the in-flight error tag.

- Cleanup stack: defer_stack now holds CleanupEntry { body, is_onfail, binding }
  (one declaration-ordered stack so defer/onfail interleave). lowerDefer pushes
  a defer entry; lowerOnFail (new `.onfail_stmt` arm) pushes an onfail entry,
  rejecting `onfail` outside a failable function.
- emitBlockDefers (success exits — return / normal block exit) now emits only
  `defer` entries and discards onfails.
- emitErrorCleanup (new; wired at the error exits — lowerRaise pure +
  value-carrying, lowerTry propagation) emits both kinds interleaved in reverse,
  binding the in-flight tag for `onfail e`.

Block-rooted: an error propagating to the function drains all enclosing blocks'
onfails; a block that exits normally discards its onfails. Per-attempt-`try`
gating is moot for now (no compilable `or` chain can absorb a mid-block try
failure yet — E2.4b). Body restrictions beyond the parser's raise-in-onfail
ban are deferred.

Tests: examples/233-onfail.sx (interleave order on error vs success + binding;
deterministic trace), examples/234-onfail-reject.sx (onfail outside a failable
fn rejected; exit 1). Gates: zig build, zig build test, 272/272 examples.

examples/233-onfail.sx

@@ -0,0 +1,42 @@
+// `onfail` — cleanup that runs only when an error LEAVES the enclosing block
+// (ERR step E1.7). Unlike `defer` (which runs on every exit), `onfail` fires
+// on an error exit — a `raise` or a propagating `try` — and is skipped on
+// success. On an error exit `defer` and `onfail` run interleaved in reverse
+// declaration order. `onfail e { … }` binds the in-flight error tag.
+// (Per-attempt-`try` gating and `or`-chain absorption refine this in E2.4b.)
+
+#import "modules/std.sx";
+
+E :: error { Bad }
+
+inner :: (n: s32) -> !E {
+    if n < 0 { raise error.Bad; }
+    return;
+}
+
+// defer + onfail interleave on the error path; only defers on success.
+run :: (n: s32) -> !E {
+    defer  print("defer A\n");
+    onfail print("onfail B\n");
+    defer  print("defer C\n");
+    try inner(n);                       // n<0 → propagates → onfail fires
+    return;
+}
+
+// `onfail e` binds the tag.
+classify :: (n: s32) -> !E {
+    onfail e { if e == error.Bad { print("cleanup: bad\n"); } }
+    if n < 0 { raise error.Bad; }
+    return;
+}
+
+main :: () -> s32 {
+    print("[fail]\n");
+    a := run(-1);                       // error → defer C, onfail B, defer A
+    print("[ok]\n");
+    b := run(7);                        // success → defer C, defer A (no onfail)
+    print("[bound]\n");
+    c := classify(-1);                  // onfail binding sees Bad
+    print("[done]\n");
+    return 0;
+}

examples/234-onfail-reject.sx

@@ -0,0 +1,15 @@
+// `onfail` rejection (ERR step E1.7): `onfail` is only valid inside a failable
+// function. A non-failable function never error-exits, so an `onfail` could
+// never fire — use `defer` for unconditional cleanup. The positive cases live
+// in `examples/233-onfail.sx`.
+
+#import "modules/std.sx";
+
+non_failable :: () -> s32 {
+    onfail print("never fires\n");   // error: onfail outside a failable function
+    return 0;
+}
+
+main :: () -> s32 {
+    return non_failable();
+}