fix(ir): release the producer's reference when boxing an owned value as Mixed (#484)

[mirchaemanuel]

Summary

Fixes #484. __rt_mixed_from_value retains refcounted payloads (objects, arrays, hashes, callables, nested cells) and persists strings, so a boxed Mixed cell always carries its own reference or copy — but EIR lowering treated Op::MixedBox as consuming its operand and never released the producer's reference. Boxing an owning temporary therefore left the payload one reference high forever:

function g(): ?P { return new P(); }   // leaked one P per call

The boxed cell itself was freed correctly on rebind; only the payload leaked (fresh arrays boxed the same way leaked identically).

Fix

A new LoweringContext::box_value_as_mixed helper emits the MixedBox and then releases the operand when it is an owning temporary — the same ownership rule as the throw-of-borrowed fix in #477. The 11 value-carrying emission sites now route through it; the two remaining direct sites box freshly-created nulls (non-refcounted, commented accordingly).

Deliberately unchanged:

• Borrowed operands (boxing a loaded local): no release — the box's retain is their +1. Verified use-after-box stays valid.
• Concat-scratch strings: the added release is a verified no-op on scratch strings, so string boxing behaviour is byte-identical; the separate persisted-copy leak is ?string return of a runtime-built string leaks the box's persisted copy once per call #485.

Verification

• Regression tests (object + array flavours) in tests/codegen/runtime_gc/regressions.rs; broad suites green (1872 codegen across callables/closures/runtime_gc/control/types/exceptions/arrays/oop/generators + 993 error tests).
• Adversarially reviewed across ~28 fixtures: no double free, no use-after-release (all converted sites' callers shadow the operand — audited one by one), IR shows exactly one release immediately after the box for owned producers and none for borrows. Closure-capture and invoker-hash shapes improve as a side effect.

Found during review (pre-existing, filed separately)

• Owned temporaries passed as mixed arguments are never released by the caller #486 — owned temporaries passed as mixed arguments still leak: that boxing happens in codegen call materialization, not EIR, so this fix doesn't reach it (mechanism detailed on the issue).
• Compound assignment with a closure/indirect call RHS accumulates only the first iteration's value #487 — compound assignment with a closure/indirect call RHS accumulates only the first iteration's value (retitled from the Closure::bind symptom after isolating the root).
• match with heterogeneous mixed arms (object/array/string) dies at runtime coercing the object arm to string #488 — match with heterogeneous mixed arms dies at runtime coercing the object arm to string.
• Owned heap temporaries consumed inside larger expressions are never released (call->prop chains, ?-> receivers, ternary arms) #483 gained the prop-get-through-Mixed shape (5 blocks/iteration) as further evidence.