lang F1 2.7: pack-as-value diagnostics (Phase 2 complete)

Using a bare pack name where a runtime value is required was silent garbage
(f(xs)/return xs produced a stray pointer). Now a clear, context-tailored
compile error: isPackName + diagPackAsValue, caught at lowerVarDecl (storage),
lowerReturn (return), lowerFor (iterate), and an identifier-arm catch-all for
call/other. Storage binds a placeholder so there is no cascade error.

Suggestions point at WORKING fixes -- materialize (..xs), or declare the slice
form ..xs: []P for runtime use. The plan category-B "spread ..xs" is broken
(spreading a comptime pack into a []Any param crashes the LLVM verifier; filed
issue 0053), so the diagnostics steer to the slice-of-protocol variadic instead.

Repurposed examples/162-pack-bare-args.sx (was an aspirational bare-$args->[]Any
auto-materialise, contradicting Decision 1) into the slice-form forward
(..args: []Any). examples/203 is the four-category negative test. specs.md "Pack
as value" updated. 238 examples + unit green.

issues/0053-comptime-pack-spread-into-any-slice.md

@@ -0,0 +1,50 @@
+# Symptom
+
+Spreading a comptime pack `..$args` into a `[]Any` parameter — `f(..args)` where
+`f` takes `items: []Any` — fails LLVM verification:
+
+```
+LLVM verification failed: Incorrect number of arguments passed to called function!
+  %call = call i64 @log_count(ptr %0, { ptr, i64 }, { ptr, i64 }, double ...)
+```
+
+The spread passes the pack's N elements as N separate positional args instead of
+materialising a single `[]Any` slice for the one `items` parameter.
+
+# Reproduction
+
+```sx
+#import "modules/std.sx";
+log_count :: (items: []Any) -> s64 { return items.len; }
+forward :: (..$args) -> s64 { return log_count(..args); }
+main :: () -> s32 { print("{}\n", forward(1, "hi", 2.5)); return 0; }
+```
+
+Expected: `3` (the pack spreads into the `[]Any` slice, like calling
+`log_count(1, "hi", 2.5)` against a `[]Any` variadic would).
+
+# Workaround / current advice
+
+Declare the forwarder as the **slice** variadic instead of a pack — then it's
+already a runtime `[]Any` and forwards directly (no spread needed):
+
+```sx
+forward :: (..args: []Any) -> s64 { return log_count(args); }   // works -> 3
+```
+
+This is what `examples/162-pack-bare-args.sx` now demonstrates, and what the
+Step 2.7 pack-as-value diagnostic recommends (declare `..xs: []P` for runtime
+use rather than spreading a pack).
+
+# Suspected area
+
+The call-arg spread lowering (`packSpreadRefs` / `lowerVariadicArgs` /
+`packVariadicCallArgs` interaction in [src/ir/lower.zig](../src/ir/lower.zig)):
+when the spread source is a comptime pack and the callee parameter is a single
+`[]Any` (not itself variadic/pack), the spread must **collect** the pack
+elements into one `[]Any` slice arg, not splat them as separate positional args.
+Compare the working path where the callee is itself a `[]Any` variadic.
+
+# Verification
+
+The reproduction above should print `3` and pass `sx ir` LLVM verification.