Cap the direct-borrow scan at max builtin arity (#546)

[InauguralPhysicist]

The post-call direct-borrow heuristic scanned the ENTIRE argument list comparing item pointers against the builtin's result. For multi-arg calls that list is the small VM-packed temp, but a single list argument is the caller's own list — so len of xs cost O(len(xs)) per call and the idiomatic loop while i < (len of xs): was quadratic: ~520x slower than a hoisted length at 88k elements (surfaced by DeslanStudios rendering 44.1 kHz audio buffers).

A borrowing builtin can only return a child it actually read, and every builtin reads its argument vector at small fixed indices (max arity in the registry is 7), so items past a small cap can never be the borrowed result. The scan is factored into vm_borrow_scan (shared by CASE(CALL), jit_helper_call, and OP_DISPATCH) and capped at 8.

The borrow contract the cap must preserve is pinned in tests/test_call_semantics.eigs: coalesce/dict_set returning a direct child of a raw list VARIABLE (not just packed temps), a borrowed child of a dying temporary argument, and a >cap-length raw list with the borrow at index 0.

88k-iteration len-in-condition loop: 5,033ms -> 17.5ms. Full release
suite: 2731/2731.

Closes #546

Claude-Session: https://claude.ai/code/session_01EKawAe121NNznQPXKiyxRf

What does this PR do?

Checklist

• make test passes locally
• New builtins have signature comments and docs in docs/BUILTINS.md
• New library functions follow conventions in docs/STDLIB.md
• New examples have a comment header explaining what they demonstrate
• CHANGELOG.md updated (if user-facing change)