comptime VM: extern slice/string args (-> NUL-term char*) + float guards (Phase 4D.2)

Extract marshalExternArg: a scalar/pointer word passes verbatim (a cstring arg
already works as a pointer word via 4D.1); a string/slice {ptr,len} fat pointer is
copied into a NUL-terminated arena buffer and its char* passed -- mirrors the legacy
marshalExternArg, and is what the bundler's popen(cmd: [:0]u8, ...) needs.

Add float guards on args AND returns: floats are kindOf == .word but the host_ffi
trampolines have no float variant, so bail loudly rather than miscall through an
integer register (the legacy interp doesn't support float FFI either -> parity).

New example 0637-comptime-extern-slice-arg (#run strlen("hello, world") with a
[:0]u8 param -> 12) runs HANDLED on the VM, byte-matching legacy. 699/0 both gates.
The FFI escape now covers scalar/pointer/cstring/slice args + scalar/pointer returns.

examples/0637-comptime-extern-slice-arg.sx

@@ -0,0 +1,14 @@
+// Comptime host-FFI with a SLICE argument: a `#run` calling a libc function whose
+// parameter is a `[:0]u8` (a `{ptr,len}` fat pointer), not a bare `cstring`. The VM
+// marshals the fat pointer to a NUL-terminated `char*` before the call (Phase 4D.2),
+// mirroring the legacy interpreter. (A bare `cstring` arg already passes as a word.)
+#import "modules/std.sx";
+
+strlen :: (s: [:0]u8) -> usize extern libc;
+
+LEN :: #run strlen("hello, world");
+
+main :: () -> i32 {
+    print("len={}\n", LEN);
+    return 0;
+}

examples/expected/0637-comptime-extern-slice-arg.exit

@@ -0,0 +1 @@
+0

examples/expected/0637-comptime-extern-slice-arg.stderr

@@ -0,0 +1 @@
+

examples/expected/0637-comptime-extern-slice-arg.stdout

@@ -0,0 +1 @@
+len=12