closures with captures: env struct + global instance + body rewriting

- AST: captureCount + captureName0..7 + captureType0..7 in Expr
- Sema: Scope_LookupUpTo + closureScope for capture analysis
- HIR Lower: env struct generation, capture assignments in skLet,
  body rewriting (ekIdent -> hFieldAccess on env instance)
- C Backend: env struct def + global instance emission for closures
- Bootstrap: full capture support in sema, hir_lower, lir_lower, lir_c_backend
- Selfhost loop remains deterministic

src/ast.bux

@@ -142,6 +142,24 @@ struct Expr {
     structFieldCount: int,
     // Closure params (for ekClosure)
     closureParams: *Decl,
+    // Captures (for ekClosure)
+    captureCount: int,
+    captureName0: String,
+    captureName1: String,
+    captureName2: String,
+    captureName3: String,
+    captureName4: String,
+    captureName5: String,
+    captureName6: String,
+    captureName7: String,
+    captureType0: int,
+    captureType1: int,
+    captureType2: int,
+    captureType3: int,
+    captureType4: int,
+    captureType5: int,
+    captureType6: int,
+    captureType7: int,
     // Call arguments (linked list for multi-arg support)
     callArgs: *ExprList,
     callArgCount: int,