fix: method on array-index/deref receiver mutates the live place (issue 0145)

A *self method called directly on arr[i] (or a deref place) fell through to an
alloca+store-of-value, so the callee mutated a throwaway copy and the live slot
was never written. fixupMethodReceiver now takes the real address of
.index_expr/.deref_expr receivers via lowerExprAsPtr (normalized to *T),
mirroring the explicit-argument path. A comptime-pack index (xs[i] where xs is
a pack) is excluded -- a pack has no runtime storage to address -- so it keeps
flowing through the general copy path.

Regression: examples/0188-types-method-array-index-receiver.sx

examples/0188-types-method-array-index-receiver.sx

@@ -0,0 +1,26 @@
+// A `*self` method called directly on an array-index place (`arr[i].method()`)
+// must mutate the LIVE array slot, not a throwaway copy. `fixupMethodReceiver`
+// now takes the real address of `.index_expr`/`.deref_expr` receivers (via
+// `lowerExprAsPtr`), mirroring the explicit-argument path — instead of falling
+// through to an alloca+store-of-value that the callee then mutates in vain.
+//
+// Regression (issue 0145).
+#import "modules/std.sx";
+
+S :: struct {
+    flag: bool;
+    set :: (self: *S) { self.flag = true; }
+}
+
+A :: struct { items: [4]S; }
+
+main :: () -> i32 {
+    a : A = .{};
+    a.items[1].set();                          // direct: must mutate the slot
+    print("direct = {}\n", a.items[1].flag);   // true
+
+    p := @a.items[1];
+    p.set();                                   // via explicit pointer
+    print("ptr    = {}\n", a.items[1].flag);   // true
+    0
+}

examples/expected/0188-types-method-array-index-receiver.exit

@@ -0,0 +1 @@
+0

examples/expected/0188-types-method-array-index-receiver.stderr

@@ -0,0 +1 @@
+

examples/expected/0188-types-method-array-index-receiver.stdout

@@ -0,0 +1,2 @@
+direct = true
+ptr    = true