ERR/E1.7: onfail — cleanup on error-exit, interleaved with defer

`onfail [e] BODY` runs cleanup only when an error LEAVES the enclosing block
(a `raise` or a propagating `try`), and is skipped on success — unlike `defer`,
which runs on every exit. On an error exit, defers and onfails run interleaved
in reverse declaration order; `onfail e` binds the in-flight error tag.

- Cleanup stack: defer_stack now holds CleanupEntry { body, is_onfail, binding }
  (one declaration-ordered stack so defer/onfail interleave). lowerDefer pushes
  a defer entry; lowerOnFail (new `.onfail_stmt` arm) pushes an onfail entry,
  rejecting `onfail` outside a failable function.
- emitBlockDefers (success exits — return / normal block exit) now emits only
  `defer` entries and discards onfails.
- emitErrorCleanup (new; wired at the error exits — lowerRaise pure +
  value-carrying, lowerTry propagation) emits both kinds interleaved in reverse,
  binding the in-flight tag for `onfail e`.

Block-rooted: an error propagating to the function drains all enclosing blocks'
onfails; a block that exits normally discards its onfails. Per-attempt-`try`
gating is moot for now (no compilable `or` chain can absorb a mid-block try
failure yet — E2.4b). Body restrictions beyond the parser's raise-in-onfail
ban are deferred.

Tests: examples/233-onfail.sx (interleave order on error vs success + binding;
deterministic trace), examples/234-onfail-reject.sx (onfail outside a failable
fn rejected; exit 1). Gates: zig build, zig build test, 272/272 examples.

tests/expected/233-onfail.exit

@@ -0,0 +1 @@
+0

tests/expected/233-onfail.txt

@@ -0,0 +1,10 @@
+[fail]
+defer C
+onfail B
+defer A
+[ok]
+defer C
+defer A
+[bound]
+cleanup: bad
+[done]

tests/expected/234-onfail-reject.exit

@@ -0,0 +1 @@
+1

tests/expected/234-onfail-reject.txt

@@ -0,0 +1,5 @@
+error: `onfail` is only valid inside a failable function (a return type with `!` or `!Named`) — use `defer` for unconditional cleanup
+  --> /Users/agra/projects/sx/examples/234-onfail-reject.sx:9:5
+   |
+ 9 |     onfail print("never fires\n");   // error: onfail outside a failable function
+   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^