t27b conformance: where the frame-address refusal stops (caller-owned slices and cells) #8053

Refs #6063

tri t27b next on lab run 7a07828 ranks ExprReturn(frame address) and StmtAssign(frame address) first and second: each blocks 2 specs the reference passes.

• ExprReturn(frame address): specs/port/browseros/trios/agent-server/apps/server/src/tools/tool-registry.t27 and specs/tri/t27b/conformance/frame_address_return.t27.
• StmtAssign(frame address): specs/port/trinity/src/tri/gen_lockfree_stack.t27 and specs/tri/t27b/conformance/frame_address_store.t27.

The refusals are right (#7550, #7735): the two port specs hand their caller a dead frame, and the reference passes them only because nothing reuses that frame before the read (#7736). #8047 rewrites both port specs so the caller owns the memory.

This issue covers the piece #8047 does not: a conformance spec, specs/tri/t27b/conformance/frame_address_caller_owned.t27, that pins where the refusal stops. A slice of a slice parameter, and a pointer parameter stored through another pointer parameter, must survive a call that clobbers 4 KiB of stack, in both the reference and t27b. If t27b ever widens the frame-address check to these shapes, this spec goes red.

The two conformance specs that pin the refusal stay blocked with reference-bug, by design.