memory: add an arena allocator behind the public Allocator contract

Context

SystemAllocator is the only allocator that Silk ships. The Allocator service is
ordinary source-declared code with no compiler privilege, so another policy can join it.
The spec names an arena as future work: "A future arena or other policy may participate
only by satisfying the same public contract without compiler-known lifetime rules"
(bootstrap-owned-allocation:124-126).

Current behavior

Every allocation goes through SystemAllocator, which calls libc malloc and free on
native LLVM and the bump pointer on Wasm. A program that makes many short-lived
allocations pays the full per-allocation cost each time. There is no way to release a
group of allocations together.

Requirements

1. An arena allocator must satisfy the same public Allocator contract as
   SystemAllocator.
2. The compiler must not branch on the arena's nominal type in the semantic phase, HIR,
   MIR, the evaluator, or either backend.
3. The arena must not introduce compiler-known lifetime rules.
4. Escaping allocation must stay unavailable. An Allocation value must not outlive the
   arena that made it.
5. The arena must release its whole region when it drops.

Example

pub struct Arena {
  region: RawBuffer
  offset: usize
}

impl Allocator for Arena {
  effect fn allocate(self: &mut Arena, layout: Layout) -> Allocation ! OutOfMemory
}

Out of scope

• Escaping arenas. The spec says these "remain unavailable"
  (bootstrap-owned-allocation:124-126).
• Any compiler change. An arena is ordinary Silk over the existing contract.
• Arena-scoped borrow checking or lifetime parameters.

Dependencies

• #21 (bulk memory operations) helps the arena reset path, but is not mandatory.

Acceptance criteria

• An acceptance test provides an Arena where a test previously provided
  SystemAllocator, and the program behaves the same.
• A test asserts the arena releases its whole region on drop.
• The existing OwnedAllocationDispatch test still shows no allocator-kind
  branching.

Start by reading the public Allocator contract and existing SystemAllocator, then locate the acceptance coverage and OwnedAllocationDispatch test mentioned in the issue. Add an Arena implementation without compiler changes, verify equivalent allocation behavior and whole-region release on drop, and confirm the dispatch test still shows no allocator-kind branching.