comptime VM: general host-FFI escape — call any extern libc fn via dlsym + host_ffi (Phase 4D.1)

Replace the "extern not ported -> bail" stub in Vm.invoke with callHostExtern:
resolve the symbol via host_ffi.lookupSymbol (dlsym RTLD_DEFAULT) and dispatch
through the host_ffi trampolines, like the legacy interp.callExtern.

Marshalling is trivial now that Addr is a real host pointer (4D.0): every WORD-kind
arg passes as usize verbatim (a scalar's bits OR a pointer, no translation), and a
pointer return is a valid Addr. Picks callPtrRet (void*-ABI) for pointer-ish
returns, callIntRet (i64-ABI) otherwise; honors variadic. Non-word
(aggregate/string/float) args+returns bail loudly (4D.2 adds them). One general
mechanism for all externs, not per-builtin special cases.

New example 0636-comptime-extern-libc (#run toupper(97)/tolower(90) -> 65/122) runs
HANDLED on the VM, output byte-matching legacy. 698/0 both gates.

examples/0636-comptime-extern-libc.sx

@@ -0,0 +1,17 @@
+// Comptime host-FFI: a `#run` that calls real libc functions (`toupper`/`tolower`)
+// at compile time. The comptime VM resolves the symbol via dlsym and dispatches
+// through the host_ffi trampolines (Phase 4D) — a scalar arg in, a scalar return
+// out — folding the result into a constant. (The legacy interpreter does the same
+// via its own dlsym path; both agree.)
+#import "modules/std.sx";
+
+toupper :: (c: i32) -> i32 extern libc;
+tolower :: (c: i32) -> i32 extern libc;
+
+UP :: #run toupper(97);   // 'a' -> 'A' = 65
+LO :: #run tolower(90);   // 'Z' -> 'z' = 122
+
+main :: () -> i32 {
+    print("toupper(97)={} tolower(90)={}\n", UP, LO);
+    return 0;
+}

examples/expected/0636-comptime-extern-libc.exit

@@ -0,0 +1 @@
+0

examples/expected/0636-comptime-extern-libc.stderr

@@ -0,0 +1 @@
+

examples/expected/0636-comptime-extern-libc.stdout

@@ -0,0 +1 @@
+toupper(97)=65 tolower(90)=122