ffi 2.16c green: TL fallback via C-helper runtime + always-omit env in #jni_call

`#jni_call` collapses to a single surface — env is *always* implicit:
either picked up from the lexically-enclosing `#jni_env(env) { ... }`
block's Ref (cheap, register-resident, no TL touch) or from the
runtime's thread-local slot via `sx_jni_env_tl_get()` (one fn call
per dispatch). The explicit-env shape is gone — chess and the
existing tests migrate cleanly by wrapping their helper-fn bodies
in `#jni_env(env) { ... }`.

The TL slot lives outside the user's IR module so the LLVM ORC JIT
can load object files cleanly without `orc_rt` for TLS support:

  library/vendors/sx_jni_runtime/sx_jni_env_tl.c:
    static _Thread_local void *sx_jni_env_tl_slot;
    void *sx_jni_env_tl_get(void) { return sx_jni_env_tl_slot; }
    void sx_jni_env_tl_set(void *env) { sx_jni_env_tl_slot = env; }

Linkage:
- sx-the-compiler links the .c file via build.zig so the JIT
  process-symbol generator resolves `sx_jni_env_tl_get`/`_set`.
- AOT targets get the same .c file auto-linked via the lowering
  pass: when lower touches the TL externs, it sets
  `needs_jni_env_tl_runtime`, and `Compilation.lowerToIR` appends a
  synthetic `CImportInfo` to `lowering_extra_c_sources` that
  `collectCImportSources` merges with user-written ones.

Lowering-side changes:
- `getJniEnvTlFids` lazily declares the two externs (parallel
  to `getSelRegisterNameFid`) and flips `needs_jni_env_tl_runtime`.
- `#jni_env(env) { body }` emits save→set→body→restore via three
  `call` ops to the externs; the inner body sees env via the
  lexical-direct stack.
- `lowerJniCall` resolves env from `jni_env_stack` (top) or the TL
  fallback. The explicit-env branch is gone.
- `jni_env_stack_base` tracks per-fn lexical scope so lazy-lowering
  a callee doesn't accidentally see the caller's Ref (Refs are only
  valid inside one fn's instruction stream).

Test migration (mechanical):
- ffi-jni-call-{01..09}: each helper fn wraps `#jni_call(...)`
  bodies in `#jni_env(env) { ... }`. Returning values pass through
  the block as an expression — `#jni_env` now also lowers in
  expression position.

Verified:
- zig build test + tests/run_examples.sh: 130/130 green.
- tests/cross_compile.sh: 3/3 green.
- Chess APK rebuilt + reinstalled on Pixel. Board renders with
  status-bar clearance + info panel intact; no crashes in logcat.
  Safe-insets dispatch through `#jni_env` + lexical-direct now
  fully exercised end-to-end on real hardware.

library/vendors/sx_jni_runtime/sx_jni_env_tl.c

@@ -0,0 +1,30 @@
+// Thread-local JNIEnv* slot for the `#jni_env(env) { body }` block and
+// the `#jni_call` cross-function fallback (FFI plan step 2.16c).
+//
+// Lives outside the user's IR module on purpose. The natural place
+// would be `@sx_jni_env_tl = internal thread_local global ptr null`
+// inside the lowered IR, but LLVM ORC JIT's default platform support
+// doesn't initialise TLS slots for objects added via
+// `LLVMOrcLLJITAddObjectFile`. Wrapping the storage in an externally-
+// linked C helper sidesteps that — JIT process-symbol resolution finds
+// these `_Thread_local`-backed functions via the host's dlsym (sx
+// itself is built with this .c linked in via build.zig); AOT targets
+// (Android, etc.) pick it up as a regular `#import c { #source ...; }`
+// auto-injected by the lowering pass.
+//
+// The slot is per-thread; nesting is handled at the call site via
+// save → set(new) → body → set(saved) (see lower.zig). Multi-VM
+// nesting needs the caller to track that themselves — the slot
+// doesn't know which JVM the env belongs to.
+
+#include <stddef.h>
+
+static _Thread_local void *sx_jni_env_tl_slot;
+
+void *sx_jni_env_tl_get(void) {
+    return sx_jni_env_tl_slot;
+}
+
+void sx_jni_env_tl_set(void *env) {
+    sx_jni_env_tl_slot = env;
+}