92/92 regression tests pass (+ffi-05-string-args).
Covers the four shapes that actually appear at the sx ↔ C boundary
today:
1. [:0]u8 string literal -> const char* (ffi_strlen, ffi_first_byte)
2. sx `string` value via .ptr (slice-decay branch in
coerceArg pulls the pointer)
3. [*]u8 raw buffer + length (ffi_sum_bytes, mutated via
ffi_write_byte and read back)
4. C-returned const char* (round-trips back as [*]u8)
The mutate-via-C path catches any pointer-aliasing regression — sx
allocates the fixed array `bytes : [4]u8`, passes `.ptr` to C which
writes index 1, and the sx side reads `bytes[1]` to confirm the
mutation took effect through the same memory.
