ffi 1.7: small struct returns through #objc_call (≤16 B + HFAs)

103/103 regression tests pass (+ffi-objc-call-05-struct-returns).
Three return shapes all round-trip cleanly with the existing Phase
1.6 `objc_msg_send` lowering — no codegen change needed because
emit_llvm.zig hands the IR struct type straight to LLVMBuildCall2
and the AArch64 / SysV AMD64 backends already know how to lower:

  NSPoint  — 16 B HFA (2×f64) → v0, v1 (AAPCS64) / xmm0, xmm1 (SysV)
  NSRange  — 16 B 2×u64       → x0, x1 register pair via [2 x i64]
  NSRect   — 32 B HFA (4×f64) → v0..v3 (AAPCS64) / xmm0..xmm3 (SysV)

Verified against the Obj-C runtime's `[nil structMethod]`-returns-
zero contract — no real-object setup needed, but the wider ABI
path runs exactly as it would for live receivers (the registers
the runtime stub uses come back through the same lowering).

>16 B non-HFA aggregates (e.g. {3×s64}) trip a sret cliff and
land in Phase 1.8. Verified locally that they return garbage in
the trailing field today — register pair / quad won't carry the
extra storage, and emit_llvm's `objc_msg_send` arm doesn't apply
the sret transform yet.

examples/ffi-objc-call-05-struct-returns.sx

@@ -0,0 +1,51 @@
+// Phase 1 step 1.7 (PLAN-FFI.md): struct returns through
+// `#objc_call`. emit_llvm's `objc_msg_send` arm hands the IR
+// struct type straight to LLVMBuildCall2; the AArch64 / SysV
+// AMD64 backend handles the register-pair / HFA / byval+sret
+// lowering as long as the function type at the call site is
+// the precise IR struct type.
+//
+// Obj-C runtime contract: `[nil structMethod]` returns a
+// zero-initialized struct of the return type. Lets us pin the
+// ABI without constructing a real object graph.
+
+#import "modules/std.sx";
+#import "modules/compiler.sx";
+
+// 16 B HFA (Apple ARM64 — 2×f64 stays in v0/v1, SysV AMD64 — in xmm0/xmm1).
+NSPoint :: struct { x: f64; y: f64; }
+
+// 16 B integer aggregate (Apple ARM64 — x0/x1 register pair, coerced
+// via `[2 x i64]` in our foreign-decl path; same trip-up that
+// issue-0036 surfaced).
+NSRange :: struct { location: u64; length: u64; }
+
+// 32 B HFA (Apple ARM64 — 4×f64 stays in v0..v3). NSRect / CGRect
+// shape. The plan singles this out because >16 B is the sret cliff
+// for *integer* aggregates, but HFAs of any size up to v0..v3 stay
+// register-resident; that distinction is what we want to lock in.
+NSRect :: struct {
+    x: f64; y: f64; width: f64; height: f64;
+}
+
+main :: () -> s32 {
+    inline if OS == .macos {
+        // 16 B HFA — both fields zero.
+        p := #objc_call(NSPoint)(null, "pointValue");
+        print("point = ({}, {})\n", p.x, p.y);
+
+        // 16 B integer — both fields zero.
+        r := #objc_call(NSRange)(null, "rangeValue");
+        print("range = ({}, {})\n", r.location, r.length);
+
+        // 32 B HFA — all four fields zero.
+        rect := #objc_call(NSRect)(null, "rectValue");
+        print("rect  = ({}, {}, {}, {})\n", rect.x, rect.y, rect.width, rect.height);
+
+        // >16 B non-HFA struct returns (sret path) land in Phase 1.8.
+    }
+    inline if OS != .macos {
+        print("skipped (not macos)\n");
+    }
+    0;
+}

tests/expected/ffi-objc-call-05-struct-returns.exit

@@ -0,0 +1 @@
+0

tests/expected/ffi-objc-call-05-struct-returns.txt

@@ -0,0 +1,3 @@
+point = (0.000000, 0.000000)
+range = (0, 0)
+rect  = (0.000000, 0.000000, 0.000000, 0.000000)