mem: allocator init returns state by value (drops state-struct heap alloc)

Building on the Option 3 lvalue-borrow rule, the long-lived allocators
in `library/modules/allocators.sx` (GPA, Arena, TrackingAllocator) now
return their state by value instead of via a heap-allocated `*T`. The
caller binds the result to a local; the local IS the allocator state.
`xx local` borrows that storage under Option 3, so the `Allocator`
protocol value's `ctx` points at the local — no heap allocation for
the state struct, no `free` of the state needed.

```sx
gpa     := GPA.init();                          // GPA (value)
arena   := Arena.init(xx gpa, 4096);            // Arena (value)
tracker := TrackingAllocator.init(xx gpa);      // TrackingAllocator (value)

push Context.{ allocator = xx tracker, data = null } { ... }
```

Why by-value:
- One fewer `libc_malloc` per allocator instance.
- No state-struct leak. The local is reclaimed at scope exit; `deinit`
  only handles downstream resources (chunks, etc.) — not its own struct.
- Owning structs can embed allocators as value fields directly.

Callsite changes:

- `library/modules/ui/pipeline.sx`: `arena_a: Arena;` / `arena_b:
  Arena;` (was `*Arena;`). The `build_arena: *Arena` local takes
  `@self.arena_a` / `@self.arena_b`.
- `examples/126-xx-recover-then-dispatch.sx`: `recovered == @gpa`
  instead of `recovered == gpa` (gpa is a value now).
- `examples/135-xx-lvalue-borrows.sx`: drop the `tracker_ptr.*`
  deref — `init` already returns the value.
- `examples/50-smoke.sx`: Arena alloc counts dropped by 1 (no
  state-struct allocation). Comments + snapshot updated.

`Arena.deinit` drops the trailing `parent.dealloc(xx a)` — the
caller's local owns the storage.

FFI IR snapshots regenerated to reflect the new signatures:
`@GPA.init` returns `i64` (was `ptr`); `@Arena.init` and
`@TrackingAllocator.init` use sret returns (was `ptr`).

CLAUDE.md "Allocator construction" rule rewritten around the
by-value convention. The forbidden caller-provides-storage and
redundant-pointer-rename patterns are still forbidden but for the
right reasons now (verbose, fragile) rather than as a workaround
for the old `init() -> *T` shape.

157/157 example tests pass; chess clean on macOS, iOS sim, and
Android via `tools/verify-step.sh`.

tests/expected/50-smoke.txt

@@ -389,12 +389,12 @@ bytes len: 3
 --- allocators ---
 gpa allocs: 2
 gpa final: 0
-arena chunks: 2
-arena overflow: 3
+arena chunks: 1
+arena overflow: 2
 arena a1: 42
 arena a3: 99
 arena reset idx: 0
-arena reset gpa: 2
+arena reset gpa: 1
 arena deinit: 0
 buf pos: 48
 buf overflow: 0

tests/expected/ffi-jni-call-03-methodid-sharing.ir

@@ -63,7 +63,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -75,7 +75,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -102,7 +102,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -736,5 +736,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-call-04-jint-return.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -711,5 +711,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-call-05-jlong-return.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -711,5 +711,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-call-06-jdouble-return.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -711,5 +711,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-call-07-jboolean-return.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -711,5 +711,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-call-08-jobject-return.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -711,5 +711,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-call-09-static.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -708,5 +708,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-class-08-call.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -711,5 +711,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-jni-env-02-lexical-direct.ir

@@ -61,7 +61,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -73,7 +73,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -100,7 +100,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -709,5 +709,3 @@ entry:
 }
 
 declare i64 @write(i32, ptr, i64)
-
-

tests/expected/ffi-objc-call-03-selector-sharing.ir

@@ -64,7 +64,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -76,7 +76,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -103,7 +103,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -792,5 +792,3 @@ entry:
   store ptr %selN, ptr @OBJC_SELECTOR_REFERENCES_release, align 8
   ret void
 }
-
-

tests/expected/ffi-objc-call-06-sret-return.ir

@@ -249,7 +249,7 @@ entry:
 }
 
 ; Function Attrs: nounwind
-declare ptr @GPA.init(ptr) #0
+declare i64 @GPA.init(ptr) #0
 
 ; Function Attrs: nounwind
 declare ptr @GPA.alloc(ptr, ptr, i64) #0
@@ -261,7 +261,7 @@ declare void @GPA.dealloc(ptr, ptr, ptr) #0
 declare void @Arena.add_chunk(ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
-declare ptr @Arena.init(ptr, ptr, i64) #0
+declare void @Arena.init(ptr sret({ ptr, i64, { ptr, ptr, ptr } }), ptr, ptr, i64) #0
 
 ; Function Attrs: nounwind
 declare void @Arena.reset(ptr, ptr) #0
@@ -288,7 +288,7 @@ declare ptr @BufAlloc.alloc(ptr, ptr, i64) #0
 declare void @BufAlloc.dealloc(ptr, ptr, ptr) #0
 
 ; Function Attrs: nounwind
-declare ptr @TrackingAllocator.init(ptr, ptr) #0
+declare void @TrackingAllocator.init(ptr sret({ { ptr, ptr, ptr }, i64, i64, i64 }), ptr, ptr) #0
 
 ; Function Attrs: nounwind
 declare i64 @TrackingAllocator.leak_count(ptr, ptr) #0
@@ -3604,5 +3604,3 @@ entry:
   store ptr %sel, ptr @OBJC_SELECTOR_REFERENCES_tripleValue, align 8
   ret void
 }
-
-