ir: auto-deref *Self when invoking a Closure-typed field (issue-0035)

When lowering `self.cb()` from inside a method whose receiver is *Self,
the field-access path passed the receiver pointer (not the aggregate)
to `structGet`, which then produced `call void undef(ptr undef)` at
the LLVM level — undefined at runtime, corrupted adjacent globals when
it transferred control to a garbage pointer. Auto-load through the
pointer first so structGet receives a real aggregate.

Discovered while building the new AndroidPlatform's `run_frame_loop` —
calling the stored frame closure as `self.frame_closure()` zeroed
out adjacent globals because the undef call jumped into random memory.

Added examples/100-closure-field-call-via-self-ptr.sx as the locked-in
regression: both direct (`self.cb()`) and hoisted (`fn := self.cb; fn();`)
forms must yield identical IR + behavior. 86/86 regression tests pass.

examples/100-closure-field-call-via-self-ptr.sx

@@ -0,0 +1,40 @@
+// Invoking a Closure-typed struct field as `self.field()` from a
+// method whose receiver is `*Self`. The field access must auto-deref
+// the pointer before extracting the closure value.
+
+#import "modules/std.sx";
+
+Holder :: struct {
+    cb: Closure() = ---;
+    has: bool = false;
+
+    set :: (self: *Holder, fn: Closure()) {
+        self.cb = fn;
+        self.has = true;
+    }
+
+    // Direct invocation through *self.
+    call_direct :: (self: *Holder) {
+        if self.has == false { return; }
+        self.cb();
+    }
+
+    // Hoist-then-call form — must agree with the direct form.
+    call_hoisted :: (self: *Holder) {
+        if self.has == false { return; }
+        fn := self.cb;
+        fn();
+    }
+}
+
+ticks : s32 = 0;
+
+main :: () -> s32 {
+    h : Holder = .{};
+    h.set(() => { ticks += 1; });
+
+    h.call_direct();
+    h.call_hoisted();
+
+    return ticks;
+}