A `mut own` aggregate parameter is passed by value, so its carrier is
fixed by the interface signature and the runtime verifier requires it to
stay exactly equal to the signature param class. Carrier inference was
upgrading such params to an object-ref carrier when they needed
projectable owned storage, contradicting the by-value param class and
tripping the verifier with SlotCarrierMismatch.

Pin signature-visible parameter carriers in both LocalStateInferer and
ReturnSliceInferer so inference never moves them off their seed. The
owned-storage need is satisfied by a Slot root instead, which the
Sonatina backend already lowers by storing the incoming arg into the
slot in the prologue.

Add an fe_test regression fixture covering array, struct, nested, and
index-mutation shapes of the pattern, plus an invariant-level unit test
(runtime_handle_preservation_keeps_mut_owned_aggregate_param_by_value)
that asserts the parameter keeps a by-value aggregate carrier backed by a
slot root, guarding against an ABI-widening "fix" that the behavioral
fixture alone would not catch.