mem: allocator init returns state by value (drops state-struct heap alloc)

Building on the Option 3 lvalue-borrow rule, the long-lived allocators
in `library/modules/allocators.sx` (GPA, Arena, TrackingAllocator) now
return their state by value instead of via a heap-allocated `*T`. The
caller binds the result to a local; the local IS the allocator state.
`xx local` borrows that storage under Option 3, so the `Allocator`
protocol value's `ctx` points at the local — no heap allocation for
the state struct, no `free` of the state needed.

```sx
gpa     := GPA.init();                          // GPA (value)
arena   := Arena.init(xx gpa, 4096);            // Arena (value)
tracker := TrackingAllocator.init(xx gpa);      // TrackingAllocator (value)

push Context.{ allocator = xx tracker, data = null } { ... }
```

Why by-value:
- One fewer `libc_malloc` per allocator instance.
- No state-struct leak. The local is reclaimed at scope exit; `deinit`
  only handles downstream resources (chunks, etc.) — not its own struct.
- Owning structs can embed allocators as value fields directly.

Callsite changes:

- `library/modules/ui/pipeline.sx`: `arena_a: Arena;` / `arena_b:
  Arena;` (was `*Arena;`). The `build_arena: *Arena` local takes
  `@self.arena_a` / `@self.arena_b`.
- `examples/126-xx-recover-then-dispatch.sx`: `recovered == @gpa`
  instead of `recovered == gpa` (gpa is a value now).
- `examples/135-xx-lvalue-borrows.sx`: drop the `tracker_ptr.*`
  deref — `init` already returns the value.
- `examples/50-smoke.sx`: Arena alloc counts dropped by 1 (no
  state-struct allocation). Comments + snapshot updated.

`Arena.deinit` drops the trailing `parent.dealloc(xx a)` — the
caller's local owns the storage.

FFI IR snapshots regenerated to reflect the new signatures:
`@GPA.init` returns `i64` (was `ptr`); `@Arena.init` and
`@TrackingAllocator.init` use sret returns (was `ptr`).

CLAUDE.md "Allocator construction" rule rewritten around the
by-value convention. The forbidden caller-provides-storage and
redundant-pointer-rename patterns are still forbidden but for the
right reasons now (verbose, fragile) rather than as a workaround
for the old `init() -> *T` shape.

157/157 example tests pass; chess clean on macOS, iOS sim, and
Android via `tools/verify-step.sh`.

library/modules/ui/pipeline.sx

@@ -18,11 +18,14 @@ UIPipeline :: struct {
     root: ViewChild;
     has_root: bool;
 
-    // Frame arena infrastructure. Both arenas are typed `*Arena`
-    // pointers (per the init-returns-typed-pointer API in
-    // allocators.sx). Cast to Allocator at use sites via `xx arena_a`.
-    arena_a: *Arena;
-    arena_b: *Arena;
+    // Frame arena infrastructure. Both arenas are embedded value-typed
+    // fields — Arena.init returns the state by value, so UIPipeline
+    // holds the storage directly. Internal code grabs `*Arena` via
+    // `@self.arena_a` when it needs to call methods through the
+    // protocol; consumers in `tick_with_body` cast to Allocator at the
+    // `push Context` site.
+    arena_a: Arena;
+    arena_b: Arena;
     frame_index: s64;
     body: Closure() -> View;
     has_body: bool;
@@ -132,7 +135,7 @@ UIPipeline :: struct {
     }
 
     tick_with_body :: (self: *UIPipeline) {
-        build_arena : *Arena = if (self.frame_index & 1) == 0 then self.arena_a else self.arena_b;
+        build_arena : *Arena = if (self.frame_index & 1) == 0 then @self.arena_a else @self.arena_b;
         build_arena.reset();
 
         // Reset render_tree nodes (backing is stale after arena reset)