iter hs.3: heap-Str runtime additions — str_alloc + int_to_str + float_to_str

Append three new symbols to runtime/str.c: a private str_alloc(uint64_t)
slab helper that allocates [rc_header | len | bytes... | NUL] via
ailang_rc_alloc and writes the len prefix, plus two extern formatters
ailang_int_to_str(int64_t) and ailang_float_to_str(double) that compose
str_alloc with snprintf("%lld") / snprintf("%g"). Defensive abort() on
truncation; 64-byte stack buffer comfortably oversized for either
formatter.

The extern declaration of ailang_rc_alloc carries __attribute__((weak)).
First regression sweep without it surfaced 11 e2e link failures under
--alloc=gc and --alloc=bump: public T-visible symbols (int_to_str /
float_to_str) pull their transitive callees (rc_alloc) into every
binary's symbol set, but rc.c is not linked under gc/bump in hs.3.
The weak attribute makes the cross-allocator link safe in isolation;
under rc the strong definition wins as usual. Retained after hs.4
(when rc.c becomes unconditionally linked) as a no-op that keeps
str.c link-safe in isolation.

No IR-side caller wired yet — hs.4 lands the IR-header declare lines,
the int_to_str/float_to_str codegen lowering, the checker install,
and the unconditional rc.c link.

cargo test --workspace + cross_lang.py + compile_check.py + check.py
all green on re-sweep.

runtime/str.c

@@ -15,6 +15,30 @@
 
 #include <stdbool.h>
 #include <string.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+/* Defined in runtime/rc.c — exposed with default external linkage.
+ * Returns a zero-initialised payload whose `rc_header` sits at
+ * `payload - 8` and is initialised to refcount 1. str.c's heap-Str
+ * helpers call this regardless of the program's --alloc strategy,
+ * because heap-Str values are always refcounted (the global
+ * `--alloc` flag governs ADT allocation, not Str allocation).
+ *
+ * Declared `__attribute__((weak))` in hs.3 so the publicly-visible
+ * `ailang_int_to_str` / `ailang_float_to_str` symbols can link into
+ * binaries that do not pull in `runtime/rc.c` (i.e. `--alloc=gc` and
+ * `--alloc=bump` targets in hs.3, where `rc.c` is not linked). Under
+ * such targets the reference resolves to NULL; the heap-Str helpers
+ * are not yet called from any IR site (hs.4 wires the lowering), so
+ * the NULL is never dereferenced at runtime. Under `--alloc=rc` the
+ * strong definition in `rc.c` wins as usual. Once hs.4 lands the
+ * unconditional `rc.c` link the `weak` attribute becomes a no-op
+ * (strong definitions always satisfy weak references); the attribute
+ * is intentionally retained so str.c remains link-safe in isolation.
+ */
+extern void *ailang_rc_alloc(size_t size) __attribute__((weak));
 
 /* Byte-equality on NUL-terminated strings. Mirrors strcmp(...) == 0
  * but exposed under a stable AILang-namespaced ABI so the codegen
@@ -38,3 +62,82 @@ int ail_str_compare(const char *a, const char *b) {
     if (r > 0) return 1;
     return 0;
 }
+
+/* Heap-Str slab allocator. Lays out:
+ *
+ *     [ rc_header (8B) | len (8B) | bytes... | NUL ]
+ *     ^                ^
+ *     payload-8        payload (returned)
+ *
+ * Calls `ailang_rc_alloc(8 + len + 1)`. The +8 is the len field;
+ * the +1 is the trailing NUL byte that keeps `@strcmp` and `@puts`
+ * happy under the shared consumer ABI. Writes `len` into the first
+ * 8 bytes of the payload and returns the payload pointer; the
+ * caller is responsible for filling bytes [8 .. 8 + len) and the
+ * `NUL` byte at offset `8 + len`.
+ *
+ * Private (static linkage) — callers within this TU only.
+ */
+static char *str_alloc(uint64_t len) {
+    char *payload = (char *)ailang_rc_alloc(8 + len + 1);
+    *(uint64_t *)payload = len;
+    return payload;
+}
+
+/* Convert an i64 into a heap-allocated Str. Format `"%lld"`. The
+ * worst-case width is 20 chars (i64::MIN = "-9223372036854775808");
+ * a 64-byte stack buffer is comfortably oversized. `snprintf`'s
+ * return tells us how many bytes *would* have been written; if that
+ * exceeds the buffer we abort() defensively — this should be
+ * unreachable for any valid i64 input but survives format-string
+ * widening if a future change ever swaps `%lld` for something more
+ * verbose without re-sizing the buffer.
+ *
+ * Returns the payload pointer of a fresh heap-Str slab. Caller owns
+ * the refcount (init to 1 by `ailang_rc_alloc`); standard RC
+ * discipline (`ailang_rc_inc` / `ailang_rc_dec`) applies.
+ */
+char *ailang_int_to_str(int64_t n) {
+    char buf[64];
+    int written = snprintf(buf, sizeof(buf), "%lld", (long long)n);
+    if (written < 0 || (size_t)written >= sizeof(buf)) {
+        fprintf(stderr,
+                "ailang_int_to_str: snprintf truncation/error "
+                "(written=%d, buffer=%zu) — should be unreachable for any valid i64; aborting\n",
+                written, sizeof(buf));
+        abort();
+    }
+    uint64_t len = (uint64_t)written;
+    char *payload = str_alloc(len);
+    memcpy(payload + 8, buf, len);
+    payload[8 + len] = '\0';
+    return payload;
+}
+
+/* Convert a double into a heap-allocated Str. Format `"%g"` —
+ * matches `io/print_float`'s libc rendering for IEEE consistency.
+ * NaN renders as libc-default (`nan`/`-nan`/etc.); ±Inf as `inf`
+ * /`-inf`. Worst-case width for `%g` on a `double` is bounded by
+ * the libc default precision (`%.6g` ⇒ at most ~13 chars including
+ * sign and exponent); the 64-byte stack buffer is comfortably
+ * oversized. Defensive `abort()` on truncation, same shape as
+ * `ailang_int_to_str`.
+ *
+ * Returns the payload pointer of a fresh heap-Str slab.
+ */
+char *ailang_float_to_str(double x) {
+    char buf[64];
+    int written = snprintf(buf, sizeof(buf), "%g", x);
+    if (written < 0 || (size_t)written >= sizeof(buf)) {
+        fprintf(stderr,
+                "ailang_float_to_str: snprintf truncation/error "
+                "(written=%d, buffer=%zu) — should be unreachable for any finite double; aborting\n",
+                written, sizeof(buf));
+        abort();
+    }
+    uint64_t len = (uint64_t)written;
+    char *payload = str_alloc(len);
+    memcpy(payload + 8, buf, len);
+    payload[8 + len] = '\0';
+    return payload;
+}