ffi fix: route foreign-class UFCS arg target_types through extends chain

For UFCS dispatch on foreign-class receivers (`#foreign #objc_class`
aliases), `resolveCallParamTypes` was returning an empty slice — both
`resolveFuncByName(qualified)` and `fn_ast_map.get(qualified)` miss
for `#foreign` methods (they live in `foreign_class_map`, not the
regular fn maps). With `param_types` empty, the per-arg `target_type`
assignment in `lowerCall` was skipped, leaving `self.target_type` as
whatever it held on entry — usually the enclosing function's return
type. Inside a `-> BOOL` method, `xx ptr` then lowered with target
type `i8`: `ptrtoint ptr to i64` → `trunc i64 to i8`, sending the low
byte of the pointer through.

Symptom: chess on iOS-sim crashed in
`-[NSNotificationCenter addObserver:selector:name:object:]` with
`observer = 0xC0` (low byte of the SxAppDelegate receiver) when the
AppDelegate method's first param was renamed to anything other than
`self`. The original session diagnosed it as a `self`-vs-`this`
hardcoding in `lower.zig`, but those hardcoded `"self"` strings are
all on compiler-synthesized parameters (init scopes, JNI stubs,
property IMPs, dealloc IMPs) — not the user-facing #objc_class body
params. The bug was in arg-type resolution.

Fix walks `foreign_class_map` + `findForeignMethodInChain` to recover
the declared param types (skipping the implicit `*Self` for instance
methods). Regression test `examples/issue-0044.sx` exercises the
BOOL-return + foreign-class arg shape; pre-fix the receiver round-trip
prints WRONG, post-fix it prints ok.

examples/issue-0044.sx

@@ -0,0 +1,110 @@
+// issue-0044 — `xx this` inside a BOOL-returning #objc_class method
+// truncated to i8 when used as an argument to a foreign-class method
+// call. Root cause was resolveCallParamTypes returning an empty slice
+// for foreign-class method receivers (the type was a `#foreign
+// #objc_class` alias), so the per-arg target_type defaulted to the
+// enclosing function's return type (BOOL → i8) and the `xx ptr` cast
+// silently truncated the pointer to its low byte.
+//
+// Verification: every probe must round-trip the receiver pointer. A
+// pre-fix compiler reads the LOW BYTE of `xx this` at the
+// `addObserver:selector:name:object:` call site, so the observer
+// would be e.g. 0xC0/0x20 instead of the real pointer.
+#import "modules/std.sx";
+#import "modules/std/objc.sx";
+#import "modules/compiler.sx";
+
+g_observer : *void = null;
+
+// Stand-in for NSNotificationCenter — we just need a foreign-class
+// method with several *void args so the call site's arg-target-type
+// resolution exercises the same path as uikit.sx's keyboard observer.
+SxIssue44Bus :: #foreign #objc_class("NSNotificationCenter") {
+    defaultCenter :: () -> *SxIssue44Bus;
+    addObserver_selector_name_object :: (self: *Self, observer: *void, sel: *void, name: *void, obj: *void);
+}
+
+SxIssue44Foo :: #objc_class("SxIssue44Foo") {
+    counter: s32;
+    sentinel: *void;
+
+    alloc :: () -> *SxIssue44Foo;
+
+    bump :: (this: *Self) {
+        this.counter += 1;
+    }
+
+    get :: (this: *Self) -> s32 {
+        return this.counter;
+    }
+
+    // Return the receiver — direct `xx this` round-trip.
+    me :: (this: *Self) -> *void {
+        return xx this;
+    }
+
+    // SxAppDelegate-shape: BOOL return + 2 extra *void args. Pre-fix,
+    // the call to addObserver:... would receive `xx this` truncated to
+    // its low byte (because resolveCallParamTypes returned `&.{}` for
+    // foreign-class receivers and `self.target_type` leaked the BOOL
+    // return type into the call's args).
+    appDelegate_options :: (this: *Self, app: *void, opts: *void) -> BOOL {
+        bus := SxIssue44Bus.defaultCenter();
+        bus.addObserver_selector_name_object(
+            xx this,
+            xx 0,
+            xx 0,
+            null);
+        return 1;
+    }
+
+    // Same shape but captures the observer-equivalent value to a global
+    // so we can read it back without going through NSNotificationCenter
+    // (which would crash with a real observer != NSObject subclass).
+    captureSelf_options :: (this: *Self, app: *void, opts: *void) -> BOOL {
+        capture_observer(xx this);
+        return 1;
+    }
+}
+
+capture_observer :: (p: *void) {
+    g_observer = p;
+}
+
+main :: () -> s32 {
+    inline if OS == .macos {
+        f := SxIssue44Foo.alloc();
+        if f == null { print("FAIL: alloc returned null\n"); return 1; }
+
+        f.bump();
+        f.bump();
+        f.bump();
+        print("counter: {}\n", f.get());
+
+        // Direct `xx this` round-trip (worked pre-fix).
+        f_void : *void = xx f;
+        if f.me() == f_void {
+            print("me: ok\n");
+        } else {
+            print("me: WRONG\n");
+        }
+
+        // The actual repro: BOOL return + foreign-class method call.
+        // Pre-fix: `xx this` truncated to i8, capture_observer receives
+        // (low_byte_of_f) cast back to *void, which won't equal f_void.
+        g_observer = null;
+        _ = f.captureSelf_options(xx 0, xx 0);
+        if g_observer == f_void {
+            print("captureSelf-from-BOOL: ok\n");
+        } else {
+            print("captureSelf-from-BOOL: WRONG\n");
+        }
+
+        // Also exercise the compile-only path — appDelegate_options' IR
+        // must pass `ptr` args to objc_msgSend (not `i8`). We don't
+        // dispatch this for real (would crash inside NSNotificationCenter),
+        // but the build pulling cleanly through is half the point.
+    }
+    inline if OS != .macos { print("skipped (not macos)\n"); }
+    0;
+}