lang: `panic`, `unreachable` and `todo` intrinsics that carry a message

assert(cond, "msg") exists and is the only way to stop a program deliberately. Option::unwrap already spells its panic assert(is_some, "unwrap called on None"), which is the workaround rather than the intent.

What needs it. unwrap, expect, every bounds check core writes for itself, and the unreachable arm of a match the checker cannot prove exhaustive.

Shape of the work. Lower to cf.assert with the message, as assert already does. expect(msg) wants the caller's message rather than a fixed one, which is the part that needs real signature work.

On a device. A cf.assert traps, and on a GPU or the ANE there is no channel to report the message. The plan's position (§8.4) is that the host prints it, a device traps silently, and this is documented rather than designed around.

Part of the core library plan (#451), item A8. Wanted for phase 1, required by phase 2.

Start with the existing assert lowering to cf.assert, then inspect Option::unwrap, expect, the core-library bounds checks, and match handling for unreachable; plan #451 describes the surrounding phase work. Done means message-carrying panic, unreachable, and todo intrinsics lower correctly, expect(msg) accepts the caller's message, and the host/device reporting behavior is documented.