Heap-boxing primitives (Box.new, std.ffi.box_ctx) accept ephemeral T

[ehartford]

Summary

Heap-boxing primitives accept ephemeral type arguments, letting a borrowed view escape onto the heap with no diagnostic. The type-erased copy (via &raw const value + with_memcpy) hides the escape from effect analysis (the by-value param is classified read-only), so neither Box.new[T] nor std.ffi.box_ctx[T] rejects an ephemeral T.

Repro

type StrView = ephemeral { s: &str }
fn main:
    let owned = "hello"
    let v = StrView { s: owned }
    let b = Box.new(v)   // compiles; borrow now lives on the heap past its scope

Impact

Boxing a borrow-holding ephemeral produces a dangling reference once the borrow's scope ends. Noted in #436 (test plan called for err_ffi_box_ephemeral); the gap is shared with Box.new, so enforcing it only for box_ctx would be inconsistent. A principled fix should reject ephemeral T at both heap-boxing entry points.

[ehartford]

Fixed by the commit above. The hole was structural: the ephemeral escape gates covered only one of four call-checking lanes — generic free fns (box_ctx), static-sig methods, and generic methods (Box.new/Rc.new — every heap constructor's actual lane) had no gating at all. All four now route through the same check; ephemeral values are rejected by value into std.box/std.rc constructors and box_ctx with a §5.1 teaching diagnostic (unsafe lane preserved, matching the task-gate precedent). Owned data and locally-consumed ephemeral args to ordinary generics stay legal. The rest of the escape class found during the blast-radius sweep is tracked: #625 (Vec[ephemeral] virality — verified freed-memory read), #626 (returned ephemeral over an owned local dangles), #627 (Box.as_ref broken outright). Pinned by err_ephemeral_box_escape / err_ephemeral_rc_escape; full gates green.