ffi 1.8b: sret transform for #objc_call(>16 B non-HFA struct)

104/104 regression tests pass. The Triple round-trip
(triple_imp writes {11, 22, 33} on the IMP side → #objc_call(Triple)
reads them back) is the test of record.

emit_llvm.zig changes:

1. `objc_msg_send` arm — when `needsByval(ret_ty)` (same predicate
   the plain-foreign-call path uses), apply the sret transform:
     - ret type collapses to void
     - prepend a `ptr` param at index 0 (call site provides an
       alloca slot)
     - mirror `sret(<RetType>)` on the call site so the AArch64 x8
       / SysV-AMD64 hidden-ptr ABI lowers correctly
     - load the result from the slot post-call
   The IR shape now matches clang exactly:
     call void @objc_msgSend(ptr sret({...}) %slot, ptr %recv, ptr %sel)

2. `.ret` arm — the body-side counterpart for sx fns whose declared
   return type is sret-shaped (sx-defined IMPs registered via
   `class_addMethod` produce these). When the current function's
   `needsByval(func.ret)` predicate holds, store the IR ret value
   through the prepended sret slot (param 0) and emit `ret void`.
   Previously the unconditional coerceArg path turned the struct
   value into `undef` and emitted `ret void undef` — illegal LLVM.

Test mechanics: registers `SxTripleProbe : NSObject` at runtime via
`objc_allocateClassPair` + `class_addMethod`, IMP returns
Triple{11, 22, 33}. `#objc_call(Triple)(instance, "tripleValue")`
gets them back, round-trip pinned in the .txt snapshot and the
IR-shape snapshot.

examples/ffi-objc-call-06-sret-return.sx

@@ -1,37 +1,48 @@
 // Phase 1 step 1.8 (PLAN-FFI.md): >16 B non-HFA struct returns
 // through `#objc_call`. AAPCS64 routes these through the indirect-
 // return convention: caller allocates the result slot, passes its
-// pointer as a hidden `x8` arg with the `sret(<T>)` attribute,
-// callee writes through it and returns void.
+// pointer in x8 with the `sret(<T>)` attribute, callee writes
+// through it and returns void.
 //
-// 1.6's `objc_msg_send` lowering hands the IR struct type straight
-// to LLVMBuildCall2 — works for ≤16 B aggregates and HFAs of any
-// size (since those stay register-resident) but breaks >16 B int
-// aggregates: LLVM accepts the signature but the AArch64 backend
-// expects the result in x0/x1, the runtime stub doesn't populate
-// those for sret-shaped returns, and the upper fields come back
-// as garbage.
-//
-// 1.8a (this commit): xfail. Snapshot shows garbage in the third
-// field — pins the broken behavior.
-// 1.8b (next commit): emit_llvm.zig applies the sret transform
-// (ret type collapses to void, prepend ptr sret param, alloca
-// slot at call site, load result post-call) for non-HFA >16 B
-// returns. Snapshot flips to all-zeros (Obj-C runtime contract).
+// Register a runtime-built Obj-C class with a method that returns
+// a fixed `Triple`. The IMP is a plain sx fn (callconv .c) — its
+// sret-shaped lowering already works (Phase 0.3 fix for plain
+// `#foreign` returns). The `#objc_call` dispatch side now produces
+// the matching call shape: `call void @objc_msgSend(ptr sret %slot,
+// ...)` + load. The two halves must agree on the ABI for the
+// round-trip to return the right bytes.
 
 #import "modules/std.sx";
 #import "modules/compiler.sx";
+#import "modules/std/objc.sx";
 
-// 24 B non-HFA integer aggregate. Distinct from any HFA path —
-// no all-float / all-double check fires.
 Triple :: struct { a: s64; b: s64; c: s64; }
 
+// IMP for the runtime-installed method. Obj-C convention: implicit
+// (self, _cmd) prefix, then declared args. Returns the value bytes.
+triple_imp :: (self: *void, _cmd: *void) -> Triple callconv(.c) {
+    Triple.{ a = 11, b = 22, c = 33 };
+}
+
 main :: () -> s32 {
     inline if OS == .macos {
-        t := #objc_call(Triple)(null, "tripleValue");
-        // Per the [nil structReturn] = 0 contract, all three fields
-        // should be 0 after 1.8b lands. Today: a/b correct, c is
-        // whatever the callee-saves left in the high register.
+        // Build the class:
+        //   @interface SxTripleProbe : NSObject
+        //     - (Triple)tripleValue;
+        //   @end
+        ns_object := objc_getClass("NSObject".ptr);
+        my_cls := objc_allocateClassPair(ns_object, "SxTripleProbe".ptr, 0);
+        sel := sel_registerName("tripleValue".ptr);
+        // Type encoding: {Triple=qqq}@: → returns 24 B struct of 3 s64,
+        // implicit (self: id, _cmd: SEL).
+        ok := class_addMethod(my_cls, sel, xx triple_imp, "{Triple=qqq}@:".ptr);
+        print("addMethod = {}\n", ok);
+        objc_registerClassPair(my_cls);
+
+        // Call through #objc_call — sret transform applies because
+        // Triple is 24 B non-HFA.
+        instance := class_createInstance(my_cls, 0);
+        t := #objc_call(Triple)(instance, "tripleValue");
         print("triple = ({}, {}, {})\n", t.a, t.b, t.c);
     }
     inline if OS != .macos {