fix(0110): for-over-array by-value fetch reads one element, not a full copy

lowerFor's by-value element fetch emitted index_get on the array VALUE;
the emitter realizes that as a whole-array spill to a stack temp + GEP,
per iteration — O(N^2) bytes copied per loop (and pre-0109 it also grew
the stack per iteration, segfaulting a [4096]s64 loop).

When the iterable is an array with addressable storage (and not deref'd
from a pointer, whose identifier alloca holds the pointer rather than
the array), the fetch is now index_gep on the storage + one element
load. Storage-less arrays keep the index_get fallback. The loaded
element remains a copy — mutating the capture does not write back.

Regression: examples/0048-basic-for-array-large.sx (sum over 4096
elements + by-value copy-guard).

examples/0048-basic-for-array-large.sx

@@ -0,0 +1,24 @@
+// Collection-form `for` over an array, by-value capture: each iteration
+// reads ONE element from the array's storage (GEP + load), and the capture
+// stays a copy — mutating it never writes back to the array.
+// Regression (issue 0110): the element fetch was `index_get` on the array
+// VALUE, spilling a full copy of the array to a stack temp per iteration —
+// O(N²) bytes copied, and (pre-0109) per-iteration stack growth that made
+// this 4096-element loop segfault.
+
+#import "modules/std.sx";
+
+main :: () -> s32 {
+    arr : [4096]s64 = ---;
+    i := 0;
+    while i < 4096 { arr[i] = i; i += 1; }
+    sum := 0;
+    for arr: (x) { sum += x; }
+    print("sum={}\n", sum);
+
+    // By-value capture is a copy: mutating it leaves the array untouched.
+    small : [3]s64 = .[10, 20, 30];
+    for small: (x) { x += 100; }
+    print("copy-guard: {} {} {}\n", small[0], small[1], small[2]);
+    0
+}

examples/expected/0048-basic-for-array-large.exit

@@ -0,0 +1 @@
+0

examples/expected/0048-basic-for-array-large.stderr

@@ -0,0 +1 @@
+

examples/expected/0048-basic-for-array-large.stdout

@@ -0,0 +1,2 @@
+sum=8386560
+copy-guard: 10 20 30