Define explicit string C and FFI bridge

[itsfuad]

Goal

Define explicit, safe conversion boundaries between Peeper strings and C or foreign-function interfaces.

Parent

Follow-up to #29. Runtime string construction and concatenation are tracked separately.

Required semantics

• Define encoding, termination, ownership, lifetime, and allocator rules at every boundary.
• Keep str, &str, and c"..." distinct.
• Define explicit conversion or adoption APIs; do not make owner-bearing ABI values implicitly C-compatible.
• Preserve raw-pointer FFI restrictions and allocator provenance established by Track allocator and free provenance #26.
• Specify inbound foreign buffers, outbound borrowed buffers, and ownership transfer separately.

Constraints

• No owner-bearing str across arbitrary extern signatures.
• No implicit NUL termination or silent embedded-NUL truncation.
• No release through allocator different from carried origin.
• No backend cast that bypasses semantic ownership checks.

Validation

• Positive fixtures for explicit outbound and inbound bridges.
• Negative fixtures for implicit owner crossing, lifetime escape, missing termination, and invalid ownership transfer.
• ABI tests across 32-bit and 64-bit targets.
• Runtime cleanup tests proving exactly one owner releases each allocation.