fix(ir): value-param type functions + range-checked dim/lane fold (0083, 0087)

Two remaining siblings in F0.4's comptime-int path.

1. Type-returning function with a value param used as a TYPE annotation
   (`b : Make(N, s64)` where `Make :: ($K: u32, $T: Type) -> Type`):
   - `isValueParamPosition` (semantic_diagnostics) now also skips a value
     param of a `fn_ast_map` type-returning function, so `N` is not walked
     as the type name "N" ("unknown type 'N'").
   - `resolveParameterizedWithBindings` routes a type-returning-function
     name to `instantiateTypeFunction` (the `.call` path already did).
   - `instantiateTypeFunction` resolves a general return-type expression
     (`return [K]T`) with bindings active — not just struct/union returns.
   `Make(N, s64)`, `Make(M + 1, s64)`, `Make(3, s64)` all resolve to one
   `[3]s64`.

2. Oversized dim/lane fold panicked the compiler (0087): an array dim /
   Vector lane folded to a valid i64 (5e9) then narrowed to u32 with an
   unchecked `@intCast`. New single gate `program_index.foldDimU32` folds
   via `evalConstIntExpr` then range-checks `[min, maxInt(u32)]`; the three
   narrowing sites (resolveArrayLen stateful + stateless, resolveVectorLane)
   all route through it and emit a clean diagnostic + halt instead of
   panicking. Value-param args stay i64 until used as a dim/lane, where the
   same gate checks them.

Regressions: examples/0208 (value-param type function), examples/1130
(oversized array dim clean halt), examples/1503 (oversized Vector lane
clean halt). Marks issue 0087 RESOLVED.

Gate: zig build, zig build test, bash tests/run_examples.sh — 398 passed,
0 failed, 0 timed out.

src/ir/program_index.zig

@@ -116,6 +116,37 @@ pub fn evalConstIntExpr(node: *const Node, ctx: anytype) ?i64 {
     };
 }
 
+/// The outcome of folding a comptime-int and narrowing it to a `u32` count
+/// (array dimension / Vector lane / value-param count). `foldDimU32` is the
+/// SINGLE place a folded integer becomes a `u32`, so the i64→u32 narrowing is
+/// range-checked exactly once and no call site does a bare `@intCast` that could
+/// panic the compiler on a valid-but-oversized fold (a literal `5_000_000_000`
+/// is a valid `i64` yet `> maxInt(u32)` — issue 0087). Each call site maps a
+/// non-`.ok` variant onto its own clean diagnostic + `.unresolved` / abort.
+pub const DimU32 = union(enum) {
+    /// Folded to a `u32` in `[min, maxInt(u32)]`.
+    ok: u32,
+    /// Not a compile-time integer (runtime value, unbound name, or overflow).
+    not_const,
+    /// Folded, but below the required minimum (a negative dim, a non-positive lane).
+    below_min: i64,
+    /// Folded, but greater than `maxInt(u32)` — too large for a `u32` count.
+    too_large: i64,
+};
+
+/// Fold `node` to a `u32` count through `evalConstIntExpr`, then range-check
+/// against `[min, maxInt(u32)]`. THE single fold-to-u32 for every array
+/// dimension, Vector lane, and value-param count — routing all of them here
+/// guarantees the narrowing is checked once and can never abort the compiler
+/// (issue 0087). The fold itself stays in `i64`; only this one conversion is the
+/// `u32` gate.
+pub fn foldDimU32(node: *const Node, ctx: anytype, min: u32) DimU32 {
+    const v = evalConstIntExpr(node, ctx) orelse return .not_const;
+    if (v < @as(i64, min)) return .{ .below_min = v };
+    if (v > std.math.maxInt(u32)) return .{ .too_large = v };
+    return .{ .ok = @intCast(v) };
+}
+
 pub const GlobalInfo = struct { id: inst.GlobalId, ty: TypeId };
 
 /// Single lowering access point for declaration-name / import / visibility