closures with captures: env struct + global instance + body rewriting

- AST: captureCount + captureName0..7 + captureType0..7 in Expr
- Sema: Scope_LookupUpTo + closureScope for capture analysis
- HIR Lower: env struct generation, capture assignments in skLet,
  body rewriting (ekIdent -> hFieldAccess on env instance)
- C Backend: env struct def + global instance emission for closures
- Bootstrap: full capture support in sema, hir_lower, lir_lower, lir_c_backend
- Selfhost loop remains deterministic

bootstrap/scope.nim

@@ -43,4 +43,14 @@ proc lookup*(scope: Scope, name: string): Symbol =
 proc lookupLocal*(scope: Scope, name: string): Symbol =
   if scope.table.hasKey(name):
     return scope.table[name]
+  return nil
+
+proc lookupUpTo*(scope: Scope, name: string, limit: Scope): Symbol =
+  var cur = scope
+  while cur != nil:
+    if cur.table.hasKey(name):
+      return cur.table[name]
+    if cur == limit:
+      break
+    cur = cur.parent
   return nil