perf(coro): remove synchronous native-call scratch allocations

[cpunion]

Summary

• replace the Go-visible pointer-taking native-call ABI with one scalar ABI and keep the array/pointer helper private to worker.c
• extend the generic SSA borrowed-allocation proof with an exact frontend call-argument certificate
• infer that certificate only for ordinary same-package, owner-backed C declarations whose memory/progress contract ends the borrow synchronously
• keep retained, asynchronous, cross-package, dynamic, deferred, spawned, ownerless, and unresolved cases conservative
• cover the positive proof, retained-memory rejection, raw-host inventory, C errno/fault behavior, and runtime source ownership

Validation

• go test ./internal/coro
• focused coroutine call/contract/frame tests in ./cl
• full runtime module test suite
• native target-plan test
• separately linked same-M callback, locked-thread compensation, deferred replacement, and worker-capability E2Es
• standard file, direct syscall, sole-M blocking pipe/timer, and loopback TCP execution gates with GOMAXPROCS=1

Measured effect

On Darwin arm64, Go 1.26.5 and LLVM 22.1.8, with exact parent/candidate builds and independent empty caches:

• standard file: 53.021 ms to 42.658 ms, -19.54%
• direct file syscall: 21.684 ms to 18.890 ms, -12.88%
• retired instructions: -10.87%
• native syscall boundary GC allocations: 2 to 0
• same-M callback boundary GC allocations: 3 to 1
• loopback TCP unchanged within noise, as expected for the poll/event path
• stripped file size: +64 bytes; Mach-O __text: -164 bytes

The performance document records complete ranges and the rejected large-struct-return ABI experiment.