[Bug] Relax ONNX frontend passes PrimType wrapper as Range dtype for shape-derived bounds

### Expected behavior

The Relax ONNX frontend should import `Range` successfully when one of its bounds is derived from ONNX shape operators. The generated `relax.arange` call should receive the underlying scalar `DataType`, such as `int64`.

### Actual behavior

The `Range` importer reads the output dtype from `start.ty.dtype`. This is a Relax `PrimType` wrapper, while `relax.op.arange` expects the underlying `DataType`.

This can break imports when a `Range` bound comes from a shape-derived `PrimExpr`, causing the importer to take the graph-building path instead of constant folding.

### Minimal pattern

```text
Shape(x) -> Gather(axis=0) -> limit
Range(start=0, limit=limit, delta=1) -> output
```

### Proposed fix

Pass `start.ty.dtype.dtype` to `relax.op.arange` and add a regression test covering the shape-derived bound.

Start at the ONNX frontend Range importer and trace how the start bound's type is passed to relax.op.arange. Reproduce the shape-derived bound pattern from the issue, use the underlying scalar DataType, and add a regression test showing that this Range import succeeds and produces the expected dtype.

Written by the indexing model from the issue text.