fix(ir): value-param type functions + range-checked dim/lane fold (0083, 0087)

Two remaining siblings in F0.4's comptime-int path.

1. Type-returning function with a value param used as a TYPE annotation
   (`b : Make(N, s64)` where `Make :: ($K: u32, $T: Type) -> Type`):
   - `isValueParamPosition` (semantic_diagnostics) now also skips a value
     param of a `fn_ast_map` type-returning function, so `N` is not walked
     as the type name "N" ("unknown type 'N'").
   - `resolveParameterizedWithBindings` routes a type-returning-function
     name to `instantiateTypeFunction` (the `.call` path already did).
   - `instantiateTypeFunction` resolves a general return-type expression
     (`return [K]T`) with bindings active — not just struct/union returns.
   `Make(N, s64)`, `Make(M + 1, s64)`, `Make(3, s64)` all resolve to one
   `[3]s64`.

2. Oversized dim/lane fold panicked the compiler (0087): an array dim /
   Vector lane folded to a valid i64 (5e9) then narrowed to u32 with an
   unchecked `@intCast`. New single gate `program_index.foldDimU32` folds
   via `evalConstIntExpr` then range-checks `[min, maxInt(u32)]`; the three
   narrowing sites (resolveArrayLen stateful + stateless, resolveVectorLane)
   all route through it and emit a clean diagnostic + halt instead of
   panicking. Value-param args stay i64 until used as a dim/lane, where the
   same gate checks them.

Regressions: examples/0208 (value-param type function), examples/1130
(oversized array dim clean halt), examples/1503 (oversized Vector lane
clean halt). Marks issue 0087 RESOLVED.

Gate: zig build, zig build test, bash tests/run_examples.sh — 398 passed,
0 failed, 0 timed out.

src/ir/semantic_diagnostics.zig

@@ -617,12 +617,28 @@ pub const UnknownTypeChecker = struct {
     /// generic `$N: u32` arg), not a type. Such a position must be skipped by
     /// the unknown-type walk: a module-const arg (`Vector(N, f32)`) is a value,
     /// not a type name. `Vector`'s arg 0 is always its lane count; a generic
-    /// struct template's value-param positions come from its declared params.
+    /// struct template's value-param positions come from its declared params; a
+    /// type-RETURNING function (`Make :: ($K: u32, $T: Type) -> Type`) classifies
+    /// each param from its constraint, mirroring `instantiateTypeFunction` — so
+    /// `Make(N, s64)` (N a module const) is not walked as the type name "N".
     fn isValueParamPosition(self: UnknownTypeChecker, base: []const u8, i: usize) bool {
         if (std.mem.eql(u8, base, "Vector")) return i == 0;
         if (self.index.struct_template_map.get(base)) |tmpl| {
             if (i < tmpl.type_params.len) return !tmpl.type_params[i].is_type_param;
         }
+        if (self.index.fn_ast_map.get(base)) |fd| {
+            if (i < fd.type_params.len) {
+                const tp = fd.type_params[i];
+                // A value param is one whose constraint is a non-`Type` type
+                // expr (`$K: u32`); a `$T: Type` (or any non-type-expr
+                // constraint) is a type param — identical rule to the binder.
+                const is_type_param = if (tp.constraint.data == .type_expr)
+                    std.mem.eql(u8, tp.constraint.data.type_expr.name, "Type")
+                else
+                    true;
+                return !is_type_param;
+            }
+        }
         return false;
     }