fix: type-safe stores + Any unbox/eq; finish multi-return deferrals

Type-checking gaps (segfault/corruption → compile errors):

- 0197: reject a store into an annotated slot whose value has no modeled
  coercion AND a different byte width (a 16-byte string into a 4-byte i32
  overran the slot and segfaulted). New checkAssignable / noneReinterpretIsUnsafe
  (coerce.zig, width via the LLVM-accurate typeSizeBytes) wired into every store
  site: var/const-decl, single + multi assignment (identifier/field/index/
  element/deref), named-return defaults. Same-width reinterpretations (*T→[*]T,
  i64→isize, fn-ref) and explicit xx/cast stay allowed; cascades suppressed via
  externalErrorsExist. Examples 1205, 1206.
- 0198: an implicit `Any → T` unbox is now a compile error (it blindly
  reinterpreted the boxed payload — silent garbage for a wrong scalar, a segfault
  for an aggregate). xx and compiler-generated match/pack unboxes are unaffected.
  Example 1207.
- 0199: `Any == <concrete>` (one operand Any) aborted the LLVM verifier — the
  comparison arm now fires when either operand is Any, boxing the concrete side
  first. Example 0654.

Multi-return deferrals (PLAN-MULTIRET #6 + named-order + D3 + generic):

- Reorder named return elements by name instead of requiring slot order; error on
  unknown/duplicate/missing (value-only AND full-failable-tuple forms). Examples
  0210, 0214.
- Reject a bare-paren (A, B) multi-return signature in generic-arg position
  (return-position-only). Example 0215.
- Multi-return closure types / lambda literals work via the reused tuple
  machinery (destructure, single-bind+field, lambda arg). Example 0216.
- Generic multi-return: positional works (0217); 0200: the named-slot
  implicit-return form now works for generic free fns + struct methods —
  monomorphizeFunction now calls bindNamedReturnSlots. Example 0218.

readme.md documents the annotated-store coercion rule; CHECKPOINT-MULTIRET.md
updated. Full corpus green (850/0).

readme.md

@@ -71,6 +71,14 @@ Options:
 A fixed array `[N]T` coerces to a slice `[]T` (its length is known); a `[*]T`
 many-pointer carries no length, so slice it explicitly with `ptr[0..len]`.
 
+Storing a value into a typed slot (a `:`-annotated binding, a field, an array
+element, a deref, an assignment target) requires a coercion to exist. A value
+with no coercion to the slot type *and* a different byte width — e.g.
+`x : i32 = "hi"` — is a **compile error** rather than a silent reinterpreting
+store. Same-width reinterpretations (`*T → [*]T`, `i64 → isize`) are allowed, and
+an explicit `xx` / `cast(T)` is always the escape hatch for a deliberate
+reinterpretation.
+
 **Numeric limits.** A field access on a builtin integer type folds to a
 compile-time constant: `i64.max`, `u8.min`, `[u8.max]T` (a 255-element array).
 Floats expose `.min` / `.max` plus `.epsilon`, `.min_positive`, `.true_min`,