fix(ir): converge the comptime-int count surface (0083)

Three adjacent cells of the shared count surface still diverged from the
rest; all now route through the same leaf+fold+narrow+diagnose path.

1. Aliased integer constraint bypassed the value-param range gate — only
   builtin constraint names matched intTypeRange, so Box(5_000_000_000)
   with `$K: Count` (Count :: u32) compiled and bound a truncated value.
   resolveValueParamArg (shared by both the struct AND type-fn binder) now
   resolves the constraint to its underlying builtin via
   canonicalIntConstraintName (Count -> u32, Small -> s8) before
   range-checking, so an aliased integer constraint behaves exactly like
   the builtin it names.

2. A named const with an expression RHS (M :: 2; N :: M + 1) did not fold
   as a count — moduleConstInt read only a literal RHS node. It now folds
   every const's RHS through the shared evalConstIntExpr, cycle-guarded
   (mutual / self cycles fold to null, not a stack overflow), and pass-0
   pre-registers expression-RHS consts. N :: M + 1 == 3 at every consumer:
   dim (direct + alias), Vector lane, value-param (struct + type-fn),
   inline for.

3. Stateful resolveArrayLen still fabricated length 0 after a failed fold;
   it now returns null -> the .unresolved sentinel (no fabrication). The
   binding's lowering never reaches sizeOf (alloca defers it; hasErrors
   aborts first) and a field access on an already-diagnosed .unresolved
   value is poison-suppressed (emitFieldError), so a failed-fold dim emits
   ONE clean diagnostic with no panic.

Regressions: examples/0146 (full positive matrix — every consumer x leaf
form), 1135 (aliased u32 + s8 overflow), 1136 (direct non-const dim halts
cleanly). The cascade cleanup also tightened 1502/1503 to one diagnostic.
Unit test added for moduleConstInt expression-folding + cycle detection.

src/ir/program_index.zig

@@ -63,6 +63,49 @@ pub fn floatToIntExact(v: f64) ?i64 {
     return @intFromFloat(v);
 }
 
+/// A frame in the chain of module consts currently being folded by
+/// `moduleConstInt`. Stack-allocated (each recursive frame lives on the Zig
+/// call stack), so cycle detection needs no allocation.
+const ModuleConstFrame = struct {
+    name: []const u8,
+    parent: ?*const ModuleConstFrame,
+};
+
+fn moduleConstFrameContains(frame: ?*const ModuleConstFrame, name: []const u8) bool {
+    var cur = frame;
+    while (cur) |c| : (cur = c.parent) {
+        if (std.mem.eql(u8, c.name, name)) return true;
+    }
+    return false;
+}
+
+/// Folding context for a module-const EXPRESSION RHS (`N :: M + 1`): a leaf name
+/// resolves to another module const via `moduleConstInt`, recursively, so the
+/// SAME shared `evalConstIntExpr` that folds an inline dim expression (`[M + 1]`)
+/// also folds an expression hidden behind a const name. `frame` is the chain of
+/// const names currently being resolved; a name already on it is a cyclic
+/// definition (`N :: N`; `N :: M + 1; M :: N`) — which has no compile-time
+/// integer value — so it folds to null (→ the clean "not a compile-time integer
+/// constant" diagnostic) rather than recursing forever. No pack arity at module
+/// scope, so `lookupPackLen` is always null.
+const ModuleConstCtx = struct {
+    consts: *const std.StringHashMap(ModuleConstInfo),
+    frame: ?*const ModuleConstFrame,
+    pub fn lookupDimName(self: ModuleConstCtx, name: []const u8) ?i64 {
+        return moduleConstIntFramed(self.consts, name, self.frame);
+    }
+    pub fn lookupPackLen(_: ModuleConstCtx, _: []const u8) ?i64 {
+        return null;
+    }
+};
+
+fn moduleConstIntFramed(consts: *const std.StringHashMap(ModuleConstInfo), name: []const u8, parent: ?*const ModuleConstFrame) ?i64 {
+    if (moduleConstFrameContains(parent, name)) return null;
+    const ci = consts.get(name) orelse return null;
+    var frame = ModuleConstFrame{ .name = name, .parent = parent };
+    return evalConstIntExpr(ci.value, ModuleConstCtx{ .consts = consts, .frame = &frame });
+}
+
 /// A name bound to a module-global integer constant → its value, else null.
 /// SINGLE source for both array-dimension resolvers — the stateful
 /// body-lowering path (`Lowering.comptimeIntNamed`) and the stateless
@@ -70,17 +113,14 @@ pub fn floatToIntExact(v: f64) ?i64 {
 /// which named consts a `[N]T` dimension resolves to; if they diverge, an array
 /// laid out via a type alias (`Arr :: [N]T`, stateless) gets a different length
 /// than the direct form (`a : [N]T`, stateful) — the issue-0083 miscompile.
-/// Untyped (`N :: 16`) and typed (`N : s64 : 16`) consts store an `.int_literal`
-/// value node; a float-typed const (`N : f64 : 4.0`, `N :: 4.0`) stores a
-/// `.float_literal` and resolves iff its value is an integral float (via
-/// `floatToIntExact`) — `4.5` is not an integer → null.
+/// Every const's RHS is folded through the shared `evalConstIntExpr`, so an
+/// untyped (`N :: 16`) / typed (`N : s64 : 16`) literal, an integral float
+/// (`N : f64 : 4.0` → 4, via `floatToIntExact`; `4.5` → null), AND an expression
+/// RHS over other consts (`M :: 2; N :: M + 1` → 3) all resolve identically and
+/// everywhere a count is accepted. Cyclic consts fold to null (see
+/// `ModuleConstCtx`).
 pub fn moduleConstInt(consts: *const std.StringHashMap(ModuleConstInfo), name: []const u8) ?i64 {
-    const ci = consts.get(name) orelse return null;
-    return switch (ci.value.data) {
-        .int_literal => |lit| lit.value,
-        .float_literal => |lit| floatToIntExact(lit.value),
-        else => null,
-    };
+    return moduleConstIntFramed(consts, name, null);
 }
 
 /// Evaluate a constant integer expression to its value. THE single