CEK-safe native call boundary: apply-cek + eval-error? marker

Native functions (NativeFn/VmClosure) called through the CEK evaluator
can now have their Eval_errors caught by guard/handler-bind. The fix is
at the exact OCaml↔CEK boundary in continue-with-call:

- sx_runtime.ml: sx_apply_cek wraps native calls, returns error marker
  dict {__eval_error__: true, message: "..."} instead of raising
- sx_runtime.ml: is_eval_error predicate checks for the marker
- spec/evaluator.sx: continue-with-call callable branch uses apply-cek,
  detects error markers, converts to raise-eval CEK state
- transpiler.sx: apply-cek and eval-error? emit cases added

No mutable flags, no re-entry risk. Errors flow through the CEK handler
chain naturally. 2798/2800 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

spec/evaluator.sx

@@ -4247,7 +4247,15 @@
         (not (lambda? f))
         (not (component? f))
         (not (island? f)))
-      (make-cek-value (apply f args) env kont)
+      (let
+        ((result (apply-cek f args)))
+        (if
+          (eval-error? result)
+          (make-cek-value
+            (get result "message")
+            env
+            (kont-push (make-raise-eval-frame env false) kont))
+          (make-cek-value result env kont)))
       (lambda? f)
       (let
         ((params (lambda-params f))