Add scoped and custom allocator behavior

[itsfuad]

Goal

Define scoped and custom allocator behavior without weakening existing owner provenance.

Baseline

#26 completed allocator provenance for owning dynamic arrays and strings: values carry origin allocator descriptors, cleanup uses carried origin, and arbitrary owner-bearing FFI is rejected.

Future scope

• Define safe user-facing custom allocator descriptors.
• Define scoped allocator and arena lifetimes.
• Prove owners cannot outlive allocator context.
• Define allocation failure behavior and allocator capability requirements.
• Replace or extend runtime bridge only after portable ABI contract is explicit.
• Reconcile stale ownership and allocator documentation before syntax or lowering work.

Hard constraints

• Destruction always uses carried origin allocator.
• Owner never outlives allocator context.
• Allocator choice does not change source type identity.
• No API may free through caller-selected mismatched allocator.
• No LLVM-only lowering shortcut may bypass semantic lifetime evidence.

Relationships

• Builds on completed provenance work in Track allocator and free provenance #26.
• String construction in Add runtime string construction and concatenation #81 must preserve this allocator contract.
• C and FFI string bridge in Define explicit string C and FFI bridge #82 must keep ownership transfer explicit.

Validation

• Semantic lifetime and escape tests for scoped allocators.
• Ownership tests for moves, returns, containers, interfaces, and cleanup.
• HIR, MIR, LLVM, and runtime tests proving origin allocator survives every carrier path.
• Negative x_test fixtures for scope escape and allocator mismatch.
• 32-bit and 64-bit ABI coverage.