Iter 17a: per-fn arena via alloca for non-escaping allocations

Adds a conservative escape analysis that flags Term::Ctor and
Term::Lam allocations as non-escaping when they are bound by a
let, never flow to a fn arg / ctor field / tail-return / lambda
capture, and remain inside the allocating fn's frame. Codegen
lowers flagged sites to LLVM `alloca` instead of `@GC_malloc`;
escaping sites continue to use Boehm.

- escape.rs (new): name-based taint propagation; let-only
  candidates; tail-position / app-arg / ctor-field / lam-capture
  all taint.
- codegen: three sites switched (lower_ctor, lam env, closure
  pair). Save/restore non_escape across lambda thunk emit.
- examples/escape_local_demo.{ailx,ail.json}: focused fixture
  exercising both branches (peek and recursive count).
- e2e + escape unit tests: 133 → 141 (+8).

Stop-gate: 17a closes the queue. Memory-management discussion
(GC scope) is the next user-driven step. Per-fn arena observations
appended to JOURNAL — including the headline finding that 0/270
shipped allocations are flagged non-escaping under this rule
(real AILang threads ctors directly between fns; build-locally /
consume-locally is not idiomatic).

All existing fixture stdouts and content hashes bit-identical;
IR snapshots unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

examples/escape_local_demo.ail.json

@@ -0,0 +1 @@
+{"defs":[{"ctors":[{"fields":[{"k":"var","name":"a"}],"name":"MkBox"}],"kind":"type","name":"Box","vars":["a"]},{"body":{"body":{"arms":[{"body":{"lit":{"kind":"int","value":42},"t":"lit"},"pat":{"ctor":"MkBox","fields":[{"p":"wild"}],"p":"ctor"}}],"scrutinee":{"name":"b","t":"var"},"t":"match"},"name":"b","t":"let","value":{"args":[{"name":"n","t":"var"}],"ctor":"MkBox","t":"ctor","type":"Box"}},"doc":"Build a Box(n), discard the payload, return 42. The Box is non-escaping.","kind":"fn","name":"peek","params":["n"],"type":{"effects":[],"k":"fn","params":[{"k":"con","name":"Int"}],"ret":{"k":"con","name":"Int"}}},{"body":{"cond":{"args":[{"name":"n","t":"var"},{"lit":{"kind":"int","value":0},"t":"lit"}],"fn":{"name":"<=","t":"var"},"t":"app"},"else":{"body":{"arms":[{"body":{"args":[{"lit":{"kind":"int","value":1},"t":"lit"},{"args":[{"args":[{"name":"n","t":"var"},{"lit":{"kind":"int","value":1},"t":"lit"}],"fn":{"name":"-","t":"var"},"t":"app"}],"fn":{"name":"count","t":"var"},"t":"app"}],"fn":{"name":"+","t":"var"},"t":"app"},"pat":{"ctor":"MkBox","fields":[{"p":"wild"}],"p":"ctor"}}],"scrutinee":{"name":"b","t":"var"},"t":"match"},"name":"b","t":"let","value":{"args":[{"name":"n","t":"var"}],"ctor":"MkBox","t":"ctor","type":"Box"}},"t":"if","then":{"lit":{"kind":"int","value":0},"t":"lit"}},"doc":"Recurse n times; each call builds a temporary Box, discards its payload via _, and returns 0 if n<=0, else 1 + count(n-1).","kind":"fn","name":"count","params":["n"],"type":{"effects":[],"k":"fn","params":[{"k":"con","name":"Int"}],"ret":{"k":"con","name":"Int"}}},{"body":{"lhs":{"args":[{"args":[{"lit":{"kind":"int","value":0},"t":"lit"}],"fn":{"name":"peek","t":"var"},"t":"app"}],"op":"io/print_int","t":"do"},"rhs":{"lhs":{"args":[{"args":[{"lit":{"kind":"int","value":123},"t":"lit"}],"fn":{"name":"peek","t":"var"},"t":"app"}],"op":"io/print_int","t":"do"},"rhs":{"lhs":{"args":[{"args":[{"lit":{"kind":"int","value":5},"t":"lit"}],"fn":{"name":"count","t":"var"},"t":"app"}],"op":"io/print_int","t":"do"},"rhs":{"args":[{"args":[{"lit":{"kind":"int","value":0},"t":"lit"}],"fn":{"name":"count","t":"var"},"t":"app"}],"op":"io/print_int","t":"do"},"t":"seq"},"t":"seq"},"t":"seq"},"kind":"fn","name":"main","params":[],"type":{"effects":["IO"],"k":"fn","params":[],"ret":{"k":"con","name":"Unit"}}}],"imports":[],"name":"escape_local_demo","schema":"ailang/v0"}

examples/escape_local_demo.ailx

@@ -0,0 +1,57 @@
+; Iter 17a — first fixture exercising the per-fn arena (alloca for
+; non-escaping allocations).
+;
+; `peek` builds a Box(n) and immediately matches on it, returning
+; a literal Int that does not depend on the box's payload. The
+; box's value is fully consumed by the local match — it never
+; flows to a fn arg, never becomes a ctor field, never returns.
+; Iter 17a's escape analysis flags the `(term-ctor Box MkBox n)`
+; allocation as non-escaping; codegen lowers it to LLVM `alloca`
+; instead of `@GC_malloc`. Boehm's heap is not touched at all by
+; this fn.
+;
+; `count` repeats the same pattern under recursion: each call to
+; `count` builds a fresh Box(_), matches it, and returns either 0
+; or 1 + (count rest). Without the alloca optimisation, each
+; recursive frame leaks a Box onto the GC heap until collection;
+; with the optimisation, each frame's Box dies with its frame.
+;
+; Expected stdout (one per line):
+;   42  — peek(0) returns the literal 42 from the only arm
+;   42  — peek(123) ditto (the input value never reaches stdout)
+;    5  — count(5)
+;    0  — count(0)
+
+(module escape_local_demo
+
+  (data Box (vars a)
+    (ctor MkBox a))
+
+  (fn peek
+    (doc "Build a Box(n), discard the payload, return 42. The Box is non-escaping.")
+    (type (fn-type (params (con Int)) (ret (con Int))))
+    (params n)
+    (body
+      (let b (term-ctor Box MkBox n)
+        (match b
+          (case (pat-ctor MkBox _) 42)))))
+
+  (fn count
+    (doc "Recurse n times; each call builds a temporary Box, discards its payload via _, and returns 0 if n<=0, else 1 + count(n-1).")
+    (type (fn-type (params (con Int)) (ret (con Int))))
+    (params n)
+    (body
+      (if (app <= n 0)
+        0
+        (let b (term-ctor Box MkBox n)
+          (match b
+            (case (pat-ctor MkBox _) (app + 1 (app count (app - n 1)))))))))
+
+  (fn main
+    (type (fn-type (params) (ret (con Unit)) (effects IO)))
+    (params)
+    (body
+      (seq (do io/print_int (app peek 0))
+      (seq (do io/print_int (app peek 123))
+      (seq (do io/print_int (app count 5))
+           (do io/print_int (app count 0))))))))