fix(0117): pointer-to-array indexing auto-derefs

A '*[N]T' receiver in an index expression reached LLVM emission with an
unresolved element type and tripped the panic sentinel — no read or
write spelling worked. ptrToArrayElem on Lowering recognises the shape;
the index READ path GEPs the pointee array through the pointer value
and loads the element; the write / compound-assign / lvalue /
addr-of-element paths and the expression typer resolve the element type
through the same helper (their GEP machinery already handled a pointer
base). Kept out of getElementType so slice paths don't half-accept a
raw pointer base.

Regression: examples/0176 (read, write, compound, element ptr + deref).

src/ir/lower.zig

@@ -1106,6 +1106,20 @@ pub const Lowering = struct {
         };
     }
 
+    /// The element type when `ty` is a POINTER TO AN ARRAY (`*[N]T` → T),
+    /// else null. Indexing auto-derefs this shape (GEP the pointee array
+    /// through the pointer value); kept OUT of `getElementType` so the
+    /// slice/subslice paths don't half-accept a raw pointer base.
+    pub fn ptrToArrayElem(self: *Lowering, ty: TypeId) ?TypeId {
+        if (ty.isBuiltin()) return null;
+        const info = self.module.types.get(ty);
+        if (info != .pointer) return null;
+        const pointee = info.pointer.pointee;
+        if (pointee.isBuiltin()) return null;
+        const pi = self.module.types.get(pointee);
+        return if (pi == .array) pi.array.element else null;
+    }
+
     pub fn isFloat(ty: TypeId) bool {
         return ty == .f32 or ty == .f64;
     }