fix: reject direct assignment to a tagged-union variant member

A tagged union (enum-with-payload) is laid out { tag, payload }, but a
direct member write `s.rect = payload` lowered to a payload-only store
(union_gep into field 1) with no tag store — the discriminant went stale,
so a later match/== took the wrong arm with no diagnostic (issue 0136).
The read path already distinguishes tagged unions (enum_payload/enum_tag);
the write path treated them like plain unions.

A variant is set via construction (`s = .variant(payload)`, which writes
both tag and payload). A direct member write can't safely set the tag (the
active variant isn't known at the write site), so it is now rejected with a
diagnostic pointing to construction. A new diagTaggedUnionVariantWrite guard
— reusing the shared fieldLvalueResolve matcher, applied at both store sites
(lowerAssignment, lowerMultiAssign) — fires only for a whole-variant write
on a tagged union. Plain `union` writes and nested sub-field writes
(`s.rect.w = ...`) are unaffected.

Resolves issue 0136. Tests: examples/0185 (rejected), 0186 (nested write +
construction still work). specs.md / readme.md updated.

readme.md

@@ -254,6 +254,11 @@ Perms :: enum flags { read; write; execute; }
 rw := Perms.read | Perms.write;
 ```
 
+Set a variant by construction (`s = .circle(2.0)`), which writes the tag and
+payload together. Direct member assignment to a variant (`s.circle = 2.0`) is
+rejected — it would set the payload but not the tag. Mutating a sub-field of the
+active variant in place (`s.rect.w = 9.0`) is fine.
+
 ### Optionals
 
 ```sx