issue-0038 fixed: closure capture through FfiIntrinsicCall args

`collectCaptures` in `src/ir/lower.zig` was the closure free-variable
analyzer that decides which names from a closure body need to be
boxed into the env struct at lambda-build time. Its switch on AST
node kind enumerated every other shape (`.call`, `.if_expr`,
`.match_expr`, `.for_expr`, etc.) but no arm for `.ffi_intrinsic_call`,
so the trailing `else => {}` quietly dropped its `args[]` and
`return_type` walks. Names referenced inside `#objc_call(T)(recv,
"sel:", ...)` from a closure body never made it into the captures
list, so when lowering bound the closure scope from env, those names
came back as "unresolved".

The fix adds the missing arm — walk `return_type` and every `args[i]`
the same way `.call` walks `callee` + `args`.

Companion changes:
- `examples/issue-0038.sx` → `examples/103-ffi-closure-capture.sx`
  (out of the open-issue namespace; comment header tightened to
  describe the feature, not the historical bug).
- `examples/ffi-objc-call-09-in-construct.sx` drops the
  `g_hasher_recv` module-global workaround that was added for this
  bug — the closure now captures `recv` from `make_hasher`'s arg
  list normally.

examples/ffi-objc-call-09-in-construct.sx

@@ -34,14 +34,11 @@ impl Hashable for Probe {
 }
 
 // ── 3. Closure body invoking #objc_call ─────────────────────────────
-// Closure-captured `recv` isn't traced through the `#objc_call` AST
-// node by sema today, so we reach the receiver via a module-level
-// global. The lemma we lock here is that lowering routes the call
-// the same way inside a closure body as it does at top level.
-g_hasher_recv : *void = null;
-
-make_hasher :: () -> Closure(s32) -> s64 {
-    closure((dummy: s32) -> s64 => #objc_call(s64)(g_hasher_recv, "hash"));
+// The closure captures `recv` from its enclosing function and
+// references it inside the `#objc_call` arg list. Locked in by
+// `examples/103-ffi-closure-capture.sx`.
+make_hasher :: (recv: *void) -> Closure(s32) -> s64 {
+    closure((dummy: s32) -> s64 => #objc_call(s64)(recv, "hash"));
 }
 
 // ── 4. Generic function body — instantiated per call site ───────────
@@ -66,11 +63,9 @@ main :: () -> s32 {
         print("protocol h2 = {}\n", h2 == h1 * 2);
 
         // 3. closure (receives a dummy arg to keep the `Closure(T) -> R`
-        //    arity matching 35-closures.sx; recv comes via a global —
-        //    closure capture through `#objc_call` AST nodes isn't
-        //    traced by sema today and would error "unresolved").
-        g_hasher_recv = ns_object;
-        hasher := make_hasher();
+        //    arity matching 35-closures.sx; `recv` is captured from
+        //    `make_hasher`'s arg list and used inside the `#objc_call`).
+        hasher := make_hasher(ns_object);
         h3 := hasher(0);
         print("closure h3  = {}\n", h3 == h1);