fix(compiler): support concrete function array elements

[oxura]

Fixes #1404.

Function values use the same one-word boxed representation regardless of their argument/result layouts. Let lay_el accept a function type alongside equality, without admitting an unresolved generic Array<T>.

The regression consumes arrays of U32 closures, swaps a closure and calls the removed value, and consumes String closures capturing heap-backed strings. Guide wording states the supported element type and preserves the Data-only get/clone boundary.

Verification (Linux, Bun 1.3.13, clang 22.1.8):

• Untouched upstream: the pure source interpreter returns 49 for a legal constructor-based array; the IO/JS and native emit paths fail with an open Array element type.
• Fixed branch: default IO execution, emitted JS and native C all print exactly 49, 19, a!b! for the permanent regression.
• Existing unresolved-generic array still refuses in both JS and C emission.
• bun gates/repo.ts: PASS 50/50; permanent caps unchanged.

The report's Array.new(U32 -> U32, ...) call independently hits the existing Data-bound argument check on current upstream, so the regression constructs affine closure cells directly; it does not change the source checker or relax the Data boundary. No mini-cluster or physical GPU run is claimed.

[nicolas-abril]

Review follow-up in #1426:

• lay_el drops the allow-list and refuses only open element types (a type variable, or an application or match stuck on one). Every other element type that isn't a datatype is one box.
• The regression test also covers a generic Array<(T -> U32)>, erased-argument function elements, and Array.set on a function array built by depth.

#1404's Array.new(U32 -> U32, …) call stays rejected on purpose, since Array.new copies its value into every leaf and needs Data. This fix is for function arrays built from constructors.

[oxura]

Thanks for the review follow-up in #1426. Understood: closed element types use a box, while open types stay rejected; Array.new still requires Data because it copies the value into leaves. I’ll preserve that boundary and won’t reopen this PR or broaden Array.new to function values.