compiler: fix the quadratic — strlen() on every character access

THE BUG. str_char_code() and str_slice() each called strlen() on every
invocation. The lexer walks source one character at a time, so every character
access rescanned the whole remaining input: O(n) per character over n
characters = O(n^2).

    el_val_t str_char_code(el_val_t s, el_val_t i) {
        ...
        int64_t n = (int64_t)strlen(str);   // <- O(n), every call
        if (idx < 0 || idx >= n) return 0;
        return str[idx];
    }

HOW IT WAS FOUND. Not by reading code — by sampling the running process, which
is the same method that resolved tonight's engram outage after four wrong
theories. A geometric sweep of synthetic sources showed wall-clock rising 3.0x,
3.0x, 4.0x, 4.14x per doubling (converging on 4x = quadratic), and a stack
sample put 779 of 779 samples inside lex(), every one bottoming out in
_platform_strlen via str_char_code and str_slice.

THE FIX. Remember the length instead of recomputing it. The subtlety is
INVALIDATION: El strings are arena-allocated, so a freed pointer can be reused
for a different string at the same address, and a naive pointer-keyed cache
would hand back a stale length and read past the end of the new string —
trading a performance bug for a memory-safety one. So entries carry a
generation, a hit requires pointer AND generation to match, and every path that
frees or mutates a runtime string bumps the generation: el_arena_pop,
seed_request_end, __str_set_char. Stale entries cannot be believed; they miss
and recompute.

MEASURED, same host, same inputs:

    n(fns)    before     after
      512      0.10s     0.01s
     1024      0.37s     0.02s
     2048      1.51s     0.03s     50x

    the compiler's own 422 KB source concatenated (DESIGN.md's 3.58s case):
              3.55s ->  0.03s      118x

The speedup GROWS with input size, which is the signature of removing a
complexity class rather than a constant factor. After the fix each doubling
adds ~0.01s: linear.

CORRECTNESS, verified rather than assumed:
  - byte-identical output on every sweep input (n = 128..2048)
  - byte-identical output on the 422 KB compiler concatenation
  - byte-identical output on tests/runtime/string_test.el
  - self-hosting fixpoint byte-identical
  - new tests/runtime/str_cache_test.el: 17 assertions covering bounds, empty
    strings, negative indices, slice clamping, distinct strings not sharing a
    cached length, 1000 interleaved strings forcing cache-slot collisions, and
    a grown string not reporting its old length. All pass.

This is the defect that made dist/soul.c a committed artifact: elc could not run
in CI because it needed 24 GB+ and minutes. It needs neither now.

lang/runtime/el_runtime.c

@@ -140,6 +140,45 @@ el_val_t el_arena_push(void) {
     return (el_val_t)(int64_t)_tl_arena.count;
 }
 
+/* ── String-length cache ─────────────────────────────────────────────────────
+ *
+ * THE COMPILER'S QUADRATIC LIVED HERE. str_char_code and str_slice each called
+ * strlen() on every invocation. The lexer walks source one character at a time,
+ * so每 access rescanned the whole remaining input: O(n) per character over n
+ * characters = O(n^2). Measured on a geometric sweep of synthetic sources,
+ * wall-clock rose 3.0x, 3.0x, 4.0x, 4.14x per doubling — converging on 4x, a
+ * textbook quadratic — and a stack sample put 779 of 779 samples inside lex(),
+ * every one bottoming out in _platform_strlen.
+ *
+ * The fix is to remember the length instead of recomputing it. The subtlety is
+ * INVALIDATION: El strings are arena-allocated, so a freed pointer can be
+ * reused for a different string at the same address. A naive pointer-keyed
+ * cache would then hand back a stale length and read past the end of the new
+ * string — trading a performance bug for a memory-safety one.
+ *
+ * So entries carry a generation. Anything that frees or mutates runtime strings
+ * bumps the generation, and a cache hit requires both the pointer AND the
+ * generation to match. Stale entries can never be believed; they simply miss
+ * and recompute.
+ * ──────────────────────────────────────────────────────────────────────────── */
+#define EL_SLC_SLOTS 8
+typedef struct { const char* ptr; size_t len; uint64_t gen; } ElStrLenEnt;
+static ElStrLenEnt _el_slc[EL_SLC_SLOTS];
+static uint64_t    _el_str_gen = 1;
+
+/* Called by every path that frees or mutates a runtime string. */
+void el_str_cache_flush(void) { _el_str_gen++; }
+
+static size_t el_strlen_cached(const char* s) {
+    if (!s) return 0;
+    size_t slot = ((uintptr_t)s >> 4) & (EL_SLC_SLOTS - 1);
+    ElStrLenEnt* e = &_el_slc[slot];
+    if (e->ptr == s && e->gen == _el_str_gen) return e->len;
+    size_t n = strlen(s);
+    e->ptr = s; e->len = n; e->gen = _el_str_gen;
+    return n;
+}
+
 el_val_t el_arena_pop(el_val_t mark) {
     size_t save = (size_t)(int64_t)mark;
     if (save > _tl_arena.count) save = 0;
@@ -152,6 +191,7 @@ el_val_t el_arena_pop(el_val_t mark) {
     _tl_arena.count = save;
     if (_tl_arena_scope_depth > 0) _tl_arena_scope_depth--;
     if (save == 0) _tl_arena_active = 0;
+    el_str_cache_flush();          /* freed pointers may be reused — see cache note */
     return 0;
 }
 
@@ -309,7 +349,7 @@ el_val_t str_to_int(el_val_t sv) {
 el_val_t str_slice(el_val_t sv, el_val_t start, el_val_t end) {
     const char* s = EL_CSTR(sv);
     if (!s) return el_wrap_str(el_strdup(""));
-    int64_t len = (int64_t)strlen(s);
+    int64_t len = (int64_t)el_strlen_cached(s);
     if (start < 0) start = 0;
     if (end > len) end = len;
     if (start >= end) return el_wrap_str(el_strdup(""));
@@ -5257,7 +5297,7 @@ el_val_t str_char_code(el_val_t s, el_val_t i) {
     const char* str = EL_CSTR(s);
     int64_t idx = (int64_t)i;
     if (!str) return 0;
-    int64_t n = (int64_t)strlen(str);
+    int64_t n = (int64_t)el_strlen_cached(str);
     if (idx < 0 || idx >= n) return 0;
     return (el_val_t)(unsigned char)str[idx];
 }