Upstream bundle (2026-08): cgen free-fn nil guard, vlib/net isize repairs, sync mutex hardening, gc.h wrapper legality #4

The staged upstream candidates from the fork's 2026-08 runtime campaign, each CX-agnostic and carried on cx-patches-0.5.2 (precedent for the submission form: vlang#27458, vlang#27658).

1. cgen: generated free fns dereference nil-default reference fields — fork @ aa29638 (closes -gc e generated free fns dereference nil-default reference fields — no nil guard (SIGSEGV); root cause of cx-private#737 #2 here). gen_free_for_struct emitted the pointee's free through reference-typed fields unconditionally; a field still holding unsafe { nil } dereferenced NULL whenever such a value was freed (module-internal v test inserts exactly such a free for option-field unwrap copies). The guard wraps pointer-field frees in both emission arms. Applies to upstream's autofree emission generally, not only this fork's collector. Ships with a 2-file minimal-repro testdata + wrapper test.

2. vlib/net: raw.c.v/udp.c.v isize/!int latent type errors — fork @ c386a89 (closes vlib/net raw.c.v + udp.c.v: isize returned as !int / passed as int — latent type errors surface when net is fully type-checked #3 here). C.sendto returns isize; both write_to_ptr fns returned it as !int and passed it to socket_error(int). Only surfaces when the import graph forces full type-checking of net.raw/net.udp. Four explicit int conversions.

3. sync: pthread lock/unlock failures were silent — fork @ d05bf35 (closes sync.Mutex.lock() silently ignores pthread_mutex_lock failure — uninitialized (zeroed __global) mutexes provide no exclusion on Darwin #1 here). Checked returns + loud panic on every lock/trylock/unlock and rwlock arm, plus a vet warning for value-typed sync.Mutex/RwMutex __globals (on darwin a zeroed pthread_mutex_t returns EINVAL — the silent no-op lock guards nothing and presents as an intermittent flake). The PTHREAD_MUTEX_ERRORCHECK build-flag extra remains optional.

4. thirdparty gc.h wrapper is not legal standalone C — the fork carries the fix (GC_noop1_ptr takes GC_word, not the V-only u64; guards plain-C shims that #include <gc.h>). Cross-check against upstream vlib/gc wrapper's emitted gc.h references V-only types, breaks C shims vlang/v#27179/vlib/gc wrapper emitted gc.h references V-only types, breaks plain-C shims vlang/v#27169 before submitting — upstream may have landed its own since.

Submission order as listed; 1 and 3 carry the field evidence (the downstream tracker's vlang#737/vlang#749 and vlang#303 lineages respectively).