Iter 14f: Boehm conservative GC

Decision 9 ships. Through Iter 14e every ADT box, lambda env, and
closure pair was leaked. This iter substitutes GC_malloc for malloc
in all four IR allocation sites and links -lgc. No language change,
no AST change, no schema change.

Diff: 5 files modified, ~30 LOC net.
- codegen/lib.rs: 4 substitutions @malloc -> @GC_malloc.
- ail/main.rs: .arg("-lgc") in the clang invocation.
- 5 IR snapshot files: mechanical s/@malloc/@GC_malloc/, 9
  occurrences. IR is bit-identical to pre-14f modulo this
  substitution — exactly Decision 9's promise.
- e2e.rs: new test gc_handles_recursive_list_construction.
- examples/gc_stress.{ailx,ail.json}: new fixture, builds a 50-
  element list via recursive Cons, sums it (1275).

Hash invariance verified: every existing fixture def hash
unchanged (codegen and link line are downstream of canonical
bytes; AST didn't move).

Tests 79 -> 80, all green. Existing 79 byte-identical stdout.
gc_stress -> 1275. list_map_poly -> 2/3/4 unchanged. sort
sorted-list unchanged. cargo doc 0 warnings.

GC notes (pertinent to future work):
- GC_INIT() not needed on Arch libgc 1.5.6 (auto-init via
  __attribute__((constructor))).
- No conservative-scan over-retention observed.
- -lgc alone sufficient for link (pthread/dl transitive).

Pattern-shape note from gc_stress fixture writing: the post-14d
"if-then-else" replacement is `(match (app == n 0) (case
(pat-lit true) ...) (case (pat-wild) ...))`. Three lines for
what `if` used to do in one, but uniform with the language.
Worth flagging for the stdlib brief.

Language is feature-complete enough for stdlib. The three
blockers identified at the 14b boundary (redundancy 14d, tail
calls 14e, GC 14f) are all done. Plan 15a: first stdlib module
std_list.ailx with length/append/reverse/map/filter/fold_left/
fold_right/head/tail/is_empty.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/ailang-codegen/src/lib.rs

@@ -291,7 +291,7 @@ pub fn lower_workspace(ws: &Workspace) -> Result<String> {
 
     out.push_str("declare i32 @printf(ptr, ...)\n");
     out.push_str("declare i32 @puts(ptr)\n");
-    out.push_str("declare ptr @malloc(i64)\n\n");
+    out.push_str("declare ptr @GC_malloc(i64)\n\n");
     out.push_str(&header);
     out.push_str(&body);
 
@@ -522,7 +522,7 @@ impl<'a> Emitter<'a> {
                 Def::Type(_) => {
                     // No LLVM definition needed: the ADT exists only as a
                     // logical type. Heap boxes are allocated ad hoc via
-                    // malloc.
+                    // GC_malloc (Boehm conservative collector, Iter 14f).
                 }
             }
         }
@@ -935,7 +935,7 @@ impl<'a> Emitter<'a> {
         let size_bytes = 8 + (compiled.len() * 8) as i64;
         let p = self.fresh_ssa();
         self.body.push_str(&format!(
-            "  {p} = call ptr @malloc(i64 {size_bytes})\n"
+            "  {p} = call ptr @GC_malloc(i64 {size_bytes})\n"
         ));
         // Write tag.
         self.body.push_str(&format!(
@@ -1787,7 +1787,7 @@ impl<'a> Emitter<'a> {
         let env_ssa = if env_size > 0 {
             let env = self.fresh_ssa();
             self.body
-                .push_str(&format!("  {env} = call ptr @malloc(i64 {env_size})\n"));
+                .push_str(&format!("  {env} = call ptr @GC_malloc(i64 {env_size})\n"));
             for (i, (_cname, outer_ssa, cty, _c_ail, _sig)) in cap_meta.iter().enumerate() {
                 let offset = (i * 8) as i64;
                 let slot = self.fresh_ssa();
@@ -1805,7 +1805,7 @@ impl<'a> Emitter<'a> {
 
         let clos = self.fresh_ssa();
         self.body
-            .push_str(&format!("  {clos} = call ptr @malloc(i64 16)\n"));
+            .push_str(&format!("  {clos} = call ptr @GC_malloc(i64 16)\n"));
         let cs_t = self.fresh_ssa();
         self.body.push_str(&format!(
             "  {cs_t} = getelementptr inbounds {{ ptr, ptr }}, ptr {clos}, i64 0, i32 0\n"