iter loop-recur.3: codegen — real LLVM-IR lowering + run-to-value E2E (milestone terminal)

Third and terminal iteration of the standalone loop/recur
milestone (plan eae73bf). Replaces the iter-1 lower_term
CodegenError::Internal stub for Term::Loop/Term::Recur with real
LLVM-IR lowering: loop binders as entry-block allocas (mut.3
pending_entry_allocas, reusing mut_var_allocas so the existing
Term::Var load path is byte-unchanged), a fresh loop-header block,
recur stores + back-edge br, a loop_frames stack saved/restored at
the lambda boundary. clang -O2 mem2reg promotes the allocas to
phi. Four Boss design calls implemented verbatim and journalled
(alloca-not-hand-phi; mut_var_allocas reuse; emergent loop-exit
via the if/match join; single block_terminated field + parallel
SET site). Diff confirmed surgical: codegen/lib.rs 3 hunks (field
+ init + stub->2-arms), lambda.rs 2 hunks (save+restore); zero
edits to any existing block_terminated SET/READ site, tail-app
lowering, or verify_tail_positions (Boss call 4, the spec-pinned
invariant). Three new .ail fixtures: sum_to->55,
deep-n 1e6->500000500000 (clause-2 correctness made executable),
infinite-loop build-only. Codegen-only: no schema/typecheck
change; hash pins + drift trio stay green untouched.

One DONE_WITH_CONCERNS (T3): the plan's `cargo test ... tail`
filter resolved to no tests; ran via real names + the full 619/0
which subsumes it (feedback_plan_pseudo_vs_reality class, no
behaviour change). Boss systemic fix folded in: planner SKILL.md
Step-5 gains item 8 (verification-command filter strings must
resolve) — the second planner-meta-gap this milestone surfaced.

cargo test --workspace 616 -> 619 / 0 red (Boss-reran
independently); the 3 loop/recur e2e explicitly green. All three
components shipped: the loop/recur milestone is structurally
complete. Milestone-close audit + fieldtest is the next step.

crates/ailang-codegen/src/lambda.rs

@@ -142,6 +142,13 @@ impl<'a> Emitter<'a> {
         // the three fields so the thunk emits its own hoisted-
         // alloca block at the thunk's entry, not the outer fn's.
         let saved_mut_allocas = std::mem::take(&mut self.mut_var_allocas);
+        // loop-recur iter 3: a lambda thunk is its own fn frame —
+        // a `recur` cannot target a loop enclosing the lambda
+        // (iter-2 typecheck already rejects it; codegen resets so
+        // the thunk's own loops work and the outer frames cannot
+        // leak in). Save + reset (mem::take empties the Vec),
+        // restored below alongside the mut.3 triple.
+        let saved_loop_frames = std::mem::take(&mut self.loop_frames);
         let saved_pending_allocas = std::mem::take(&mut self.pending_entry_allocas);
         let saved_entry_marker = self.entry_block_end_marker.take();
         // Iter 18d.4 fix: a lambda thunk is its own fn frame for
@@ -256,6 +263,7 @@ impl<'a> Emitter<'a> {
         self.current_param_modes = saved_param_modes;
         // Iter mut.3: restore outer fn's mut-var bookkeeping.
         self.mut_var_allocas = saved_mut_allocas;
+        self.loop_frames = saved_loop_frames;
         self.pending_entry_allocas = saved_pending_allocas;
         self.entry_block_end_marker = saved_entry_marker;