ERR/E3.3: trace formatting (library/modules/trace.sx) + catch-clear timing fix

The trace formatter, unblocked now that 0057 is fixed.

- library/modules/trace.sx: to_string() walks the trace buffer (sx_trace_len /
  frame_at / truncated) and renders "error return trace ..." with one line per
  frame; print_current() writes it to stderr (libc write(2, ...)). Frame
  locations are "<location pending DWARF>" until E3.0 resolves PCs; count +
  ordering + the overflow note are already meaningful.

- Catch-clear timing fix (lowerCatch): move the absorption clear from
  runCatchBody ENTRY to the handler's non-diverging EXIT (both the pure and
  value-carrying paths). This reconciles the two PLAN-ERR statements that
  conflicted — §clear-points "buffer cleared before the catch body" vs
  §catch-over-or "frames still in the buffer when the body runs". Exit-clear
  satisfies both: the handler can inspect the trace (trace.print_current()
  shows the chain), and the buffer is empty once the handler completes. A
  diverging body (raise/return) keeps/discards on its own path.

- examples/243-trace-format.sx: catch handler prints the tag + the 2-frame
  trace, then shows the buffer is empty after. examples/241 updated: the
  handler now observes len=2 (was 0 under the buggy entry-clear).

Gates: zig build, zig build test, bash tests/run_examples.sh (280 passed; lone
failure is the user's uncommitted 213-canonical-map pack WIP).

examples/241-error-trace-buffer.sx

@@ -24,12 +24,14 @@ propagate :: (n: s32) -> !E {
 }
 
 main :: () -> s32 {
-    // `catch` absorbs the failure → buffer cleared before the handler runs.
+    // `catch` lets the handler INSPECT the trace, then absorbs: the buffer is
+    // cleared when the handler completes (a non-diverging exit), not on entry.
+    // So inside the handler the frames are still visible (here: the `raise` in
+    // `fail` + the `try fail` propagation in `propagate` = 2 frames)...
     propagate(-1) catch e {
-        // The pushes from `raise` + `try` were cleared on catch entry.
-        print("in catch: len={}\n", sx_trace_len());   // 0
+        print("in catch: len={}\n", sx_trace_len());   // 2 (handler sees the chain)
     };
-    print("after catch: len={}\n", sx_trace_len());     // 0
+    print("after catch: len={}\n", sx_trace_len());     // 0 (absorbed at handler exit)
 
     // A success leaves the buffer empty (nothing pushed).
     propagate(1) catch e { };

examples/243-trace-format.sx

@@ -0,0 +1,36 @@
+// Error return-trace formatting (ERR step E3.3). `library/modules/trace.sx`
+// reads the trace buffer (E3.1, populated by E3.2's raise/try push wiring) and
+// renders it. `trace.print_current()` writes the trace to stderr; the catch
+// handler sees the full chain because the absorption clear fires at handler
+// EXIT, not entry. Frame locations are placeholders until DWARF (ERR E3.0)
+// resolves PCs to file:line; the count + ordering are already meaningful.
+//
+// Note: the trace goes to stderr. The test runner merges stderr+stdout, so the
+// snapshot shows the trace lines interleaved with the `print` (stdout) lines.
+
+#import "modules/std.sx";
+trace :: #import "modules/trace.sx";
+
+// Buffer length probe (the runtime symbol; public read API is the trace module).
+sx_trace_len :: () -> u32 #foreign;
+
+E :: error { BadInput, Overflow }
+
+leaf :: (n: s32) -> !E {
+    if n < 0 { raise error.BadInput; }   // pushes frame 0
+    return;
+}
+
+mid :: (n: s32) -> !E {
+    try leaf(n);                          // propagation pushes frame 1
+    return;
+}
+
+main :: () -> s32 {
+    mid(-1) catch e {
+        print("[stdout] caught {}\n", e);   // tag name via the always-linked table
+        trace.print_current();               // [stderr] the 2-frame trace
+    };
+    print("[stdout] recovered; trace buffer now empty (len {})\n", sx_trace_len());
+    return 0;
+}