Add raw pointer address escape checks

[itsfuad]

Summary

• add @expr address operator with mutable and const raw pointer typing
• move raw pointer escape analysis into dedicated ownership phase after typechecking
• reject returning pointers known to point at local storage, while allowing module-scope const addresses
• preserve address-of field storage via MIR FieldAddr so @box.field does not become pointer to a temp copy

Follow-up

• Refactor MIR field/index access to projection places #32 tracks MIR projection/place refactor before arrays, slices, maps, or any future addressable composite work
• hard line: do not add IndexAddr, SliceAddr, or MapAddr nodes; pivot to Project + Load/Store or generalized Place first

Validation

• env GOCACHE=/tmp/peeper-go-cache go test ./internal/semantics/ownership ./internal/semantics/typechecker ./internal/ir/hir_lower ./internal/ir/mir ./internal/backend/llvm ./internal/pipeline -timeout 120s -count=1 -p 2
• env GOCACHE=/tmp/peeper-go-cache go test ./... -timeout 120s -count=1 -p 2
• git diff --check
• env GOCACHE=/tmp/peeper-go-cache go run ./scripts/bundle.go