sx: step 1 — fix JIT call_closure_reuse for closure returns

In `call_closure_reuse`, the success path used a bare `pop vm` that relied on
OP_RETURN having left the stack at exactly `saved_sp + 1`. When the callee
returns a closure (or hits the bytecode-exhausted fallback path), `vm.sp` can
end up inconsistent with the parent frame's expected layout, corrupting
intermediate values such as parser combinator state in `parse-bind`/`many`/
`seq`.

Fix: read the result at the expected slot, then explicitly reset
`vm.sp <- saved_sp` before returning so the parent frame sees a clean stack
regardless of what the callee left behind.

OCaml run_tests baseline: 4525/5864 unchanged. WASM kernel tests: 24/29
unchanged. No regressions.

plans/sx-improvements.md

@@ -181,7 +181,7 @@ these when operands are known numbers/lists.
 
 | Step | Status | Commit |
 |------|--------|--------|
-| 1 — JIT combinator bug | [ ] | — |
+| 1 — JIT combinator bug | [x] | 6297a380 |
 | 2 — letrec+resume | [ ] | — |
 | 3 — tokenizer :end/:line | [ ] | — |
 | 4 — parser spans complete | [ ] | — |