ffi 0.9: foreign-result chains — handle threaded through struct + List

96/96 regression tests pass (+ffi-09-foreign-result-chain).

Opaque C-handle pattern that mirrors how real sx code threads
MTLBuffer*, AAssetManager*, file pointers, etc. through composite
sx values. C side has a trivial heap-int handle (`ffi_chain_make`
returning `void*`, `ffi_chain_bump` / `_peek` / `_dispose`). The sx
side exercises:

  1. Chained calls   — make -> bump -> bump -> peek; one handle
                       threaded through four FFI sites in sequence.
  2. Struct field    — `Counter { handle: *void; label: string; }`
                       hosts the handle; methods/accesses go through
                       `.handle` to feed back into C.
  3. List(*void)     — push N handles, iterate, peek each, iterate
                       again to bump each, iterate again to read
                       back. Catches any aliasing / lifetime breakage
                       when handles round-trip through the slice
                       backing of List.

examples/ffi-09-foreign-result-chain.c

@@ -0,0 +1,22 @@
+#include "ffi-09-foreign-result-chain.h"
+#include <stdlib.h>
+
+void *ffi_chain_make(int seed) {
+    int *p = (int *)malloc(sizeof(int));
+    if (p) *p = seed;
+    return p;
+}
+
+int ffi_chain_bump(void *h, int delta) {
+    int *p = (int *)h;
+    *p += delta;
+    return *p;
+}
+
+int ffi_chain_peek(void *h) {
+    return *(int *)h;
+}
+
+void ffi_chain_dispose(void *h) {
+    free(h);
+}