mem: allocator init returns state by value (drops state-struct heap alloc)

Building on the Option 3 lvalue-borrow rule, the long-lived allocators
in `library/modules/allocators.sx` (GPA, Arena, TrackingAllocator) now
return their state by value instead of via a heap-allocated `*T`. The
caller binds the result to a local; the local IS the allocator state.
`xx local` borrows that storage under Option 3, so the `Allocator`
protocol value's `ctx` points at the local — no heap allocation for
the state struct, no `free` of the state needed.

```sx
gpa     := GPA.init();                          // GPA (value)
arena   := Arena.init(xx gpa, 4096);            // Arena (value)
tracker := TrackingAllocator.init(xx gpa);      // TrackingAllocator (value)

push Context.{ allocator = xx tracker, data = null } { ... }
```

Why by-value:
- One fewer `libc_malloc` per allocator instance.
- No state-struct leak. The local is reclaimed at scope exit; `deinit`
  only handles downstream resources (chunks, etc.) — not its own struct.
- Owning structs can embed allocators as value fields directly.

Callsite changes:

- `library/modules/ui/pipeline.sx`: `arena_a: Arena;` / `arena_b:
  Arena;` (was `*Arena;`). The `build_arena: *Arena` local takes
  `@self.arena_a` / `@self.arena_b`.
- `examples/126-xx-recover-then-dispatch.sx`: `recovered == @gpa`
  instead of `recovered == gpa` (gpa is a value now).
- `examples/135-xx-lvalue-borrows.sx`: drop the `tracker_ptr.*`
  deref — `init` already returns the value.
- `examples/50-smoke.sx`: Arena alloc counts dropped by 1 (no
  state-struct allocation). Comments + snapshot updated.

`Arena.deinit` drops the trailing `parent.dealloc(xx a)` — the
caller's local owns the storage.

FFI IR snapshots regenerated to reflect the new signatures:
`@GPA.init` returns `i64` (was `ptr`); `@Arena.init` and
`@TrackingAllocator.init` use sret returns (was `ptr`).

CLAUDE.md "Allocator construction" rule rewritten around the
by-value convention. The forbidden caller-provides-storage and
redundant-pointer-rename patterns are still forbidden but for the
right reasons now (verbose, fragile) rather than as a workaround
for the old `init() -> *T` shape.

157/157 example tests pass; chess clean on macOS, iOS sim, and
Android via `tools/verify-step.sh`.

library/modules/allocators.sx

@@ -28,18 +28,21 @@ impl Allocator for CAllocator {
 
 // --- GPA: general purpose allocator (malloc/free wrapper) ---
 //
+// `init` returns the GPA by value. Caller binds it to a local; the
+// local IS the allocator state, no heap-side allocation for the
+// struct itself. `xx gpa` borrows the local under Option 3, so the
+// Allocator protocol value's `ctx` points at the local.
+//
 // Usage:
-//   gpa := GPA.init();                                    // *GPA
+//   gpa := GPA.init();                                    // GPA
 //   push Context.{ allocator = xx gpa, data = null } { ... }
 //   print("alloc count: {}\n", gpa.alloc_count);
 
 GPA :: struct {
     alloc_count: s64;
 
-    init :: () -> *GPA {
-        g : *GPA = xx libc_malloc(size_of(GPA));
-        g.alloc_count = 0;
-        g;
+    init :: () -> GPA {
+        GPA.{ alloc_count = 0 };
     }
 }
 
@@ -56,12 +59,17 @@ impl Allocator for GPA {
 
 // --- Arena: multi-chunk bump allocator ---
 //
+// `init` returns the Arena by value; the caller's local holds the
+// state, no heap-side allocation for the struct itself. The arena's
+// chunks ARE heap-allocated through the parent allocator, but those
+// are owned by `deinit` (or `reset` for the non-first ones).
+//
 // Usage:
 //   gpa   := GPA.init();
-//   arena := Arena.init(xx gpa, 4096);                    // *Arena
+//   arena := Arena.init(xx gpa, 4096);                    // Arena
 //   push Context.{ allocator = xx arena, data = null } { ... }
-//   arena.reset();   // direct method on *Arena
-//   arena.deinit();
+//   arena.reset();   // free all chunks except the first
+//   arena.deinit();  // free every chunk
 
 ArenaChunk :: struct {
     next: *ArenaChunk;
@@ -85,11 +93,8 @@ Arena :: struct {
         a.end_index = 0;
     }
 
-    init :: (parent_alloc: Allocator, size: s64) -> *Arena {
-        self : *Arena = xx parent_alloc.alloc(size_of(Arena));
-        self.first = null;
-        self.end_index = 0;
-        self.parent = parent_alloc;
+    init :: (parent_alloc: Allocator, size: s64) -> Arena {
+        self : Arena = .{ first = null, end_index = 0, parent = parent_alloc };
         self.add_chunk(size);
         self;
     }
@@ -114,8 +119,8 @@ Arena :: struct {
             a.parent.dealloc(it);
             it = next;
         }
-        parent := a.parent;
-        parent.dealloc(xx a);
+        a.first = null;
+        a.end_index = 0;
     }
 }
 
@@ -190,7 +195,7 @@ impl Allocator for BufAlloc {
 //
 // Manual opt-in pattern (compiler auto-wrap lands in Phase 5):
 //
-//   tracker := TrackingAllocator.init(context.allocator);   // *TrackingAllocator
+//   tracker := TrackingAllocator.init(context.allocator);   // TrackingAllocator
 //   push Context.{ allocator = xx tracker, data = null } {
 //       // ... user code allocates via tracker → delegates to the
 //       //     original context.allocator (libc-backed by default) ...
@@ -210,13 +215,13 @@ TrackingAllocator :: struct {
     dealloc_count: s64;
     total_alloc_bytes: s64;
 
-    init :: (parent_alloc: Allocator) -> *TrackingAllocator {
-        t : *TrackingAllocator = xx parent_alloc.alloc(size_of(TrackingAllocator));
-        t.parent = parent_alloc;
-        t.alloc_count = 0;
-        t.dealloc_count = 0;
-        t.total_alloc_bytes = 0;
-        t;
+    init :: (parent_alloc: Allocator) -> TrackingAllocator {
+        TrackingAllocator.{
+            parent = parent_alloc,
+            alloc_count = 0,
+            dealloc_count = 0,
+            total_alloc_bytes = 0,
+        };
     }
 
     leak_count :: (t: *TrackingAllocator) -> s64 {

library/modules/ui/pipeline.sx

@@ -18,11 +18,14 @@ UIPipeline :: struct {
     root: ViewChild;
     has_root: bool;
 
-    // Frame arena infrastructure. Both arenas are typed `*Arena`
-    // pointers (per the init-returns-typed-pointer API in
-    // allocators.sx). Cast to Allocator at use sites via `xx arena_a`.
-    arena_a: *Arena;
-    arena_b: *Arena;
+    // Frame arena infrastructure. Both arenas are embedded value-typed
+    // fields — Arena.init returns the state by value, so UIPipeline
+    // holds the storage directly. Internal code grabs `*Arena` via
+    // `@self.arena_a` when it needs to call methods through the
+    // protocol; consumers in `tick_with_body` cast to Allocator at the
+    // `push Context` site.
+    arena_a: Arena;
+    arena_b: Arena;
     frame_index: s64;
     body: Closure() -> View;
     has_body: bool;
@@ -132,7 +135,7 @@ UIPipeline :: struct {
     }
 
     tick_with_body :: (self: *UIPipeline) {
-        build_arena : *Arena = if (self.frame_index & 1) == 0 then self.arena_a else self.arena_b;
+        build_arena : *Arena = if (self.frame_index & 1) == 0 then @self.arena_a else @self.arena_b;
         build_arena.reset();
 
         // Reset render_tree nodes (backing is stale after arena reset)