feat(lang): L7 memory is safe unless it says unsafe

The typed buffers are slices: words/floats/fixeds/doubles/pointers(n) make
zeroed, bounds-checked []int/[]float/... and the type names mean them. buffer(n)
is a []byte, with text_of, Fs.read_bytes/write_bytes and view(xs, start, n).
bytes(), indexing a raw pointer or bytes, free, resize, Memory.*, raw file calls,
data_of and C externs are refused outside unsafe { } / unsafe function, and a
project's own files may write unsafe only with --unsafe; the runtime and packages
are the platform. A slice passed to an extern goes as its data.

What the change found: Sync's atomics on a slice header, words(n) uninitialised,
input's fixed axes in ints, truetype's fixed outlines as ints, skin matrices
typed int, gl_shader's source table made from raw bytes. render3d gets safe
entry points (safe_api.ludic). Rendering is byte-identical; a frame costs the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

runtime/native/audio.ludic

@@ -31,9 +31,9 @@ var snd_bank_n:    int      = 0
 
 function audio_init() -> void {
   if snd_ready { return }
-  snd_tab = bytes(AUDIO_CAP * 8)     # one 8-byte pointer slot per handle
+  snd_tab = pointers(AUDIO_CAP)     # one 8-byte pointer slot per handle
   fill(snd_tab, 0, AUDIO_CAP * 8)    # malloc does not zero; empty slots must read null
-  snd_bank_name = bytes(AUDIO_CAP * 8)
+  snd_bank_name = pointers(AUDIO_CAP)
   snd_bank_id = words(AUDIO_CAP)
   snd_ready = true
 }