* ZJIT: Share a single JITFrame across all C method frames

Replace the per-call JITFrame::new_cfunc allocation in gen_push_frame
with a sentinel value (ZJIT_JIT_RETURN_C_FRAME) stored in cfp->jit_return.
CFP_ZJIT_FRAME now returns a pointer to a single static rb_zjit_c_frame
(pc/iseq both NULL) when it sees the sentinel.

The CFP accessor is split into CFP_ZJIT_FRAME_P (predicate) and
CFP_ZJIT_FRAME (typed accessor that dereferences safely) so callers don't
have to know about the sentinel encoding. ISEQ frames are unchanged: they
still hand cfp->jit_return a heap-allocated JITFrame pointer.

* Move a pointer location for CFP_ZJIT_FRAME

The `too_` prefix wasn't consistently used and just make the
thing longer for no benefit.

A good poison value gives a recognizable fault address if someone
erroneously dereferences. Asserting the pointer is not poison shouldn't
be necessary, so move it to RUBY_DEBUG builds.

The zjit-bindgen CI check regenerates cruby_bindings.inc.rs from
headers and diffs against the committed file. Since rb_flo_to_i is
declared next to rb_float_plus/minus/mul/div in internal/numeric.h,
bindgen emits it there. Match that order in both the allowlist and
the generated output.

The previous commit exposed flo_to_i as a non-static global, which
tripped tool/leaked-globals because it lacks the rb_ prefix.

Keep flo_to_i static and add a new public wrapper rb_flo_to_i in
numeric.c that delegates to it. ZJIT now calls rb_flo_to_i directly
from Rust (no zjit.c wrapper needed).

Address review feedback:
1. Move the helper from jit.c (shared YJIT/ZJIT glue) to zjit.c since
   it is only used by ZJIT.
2. Instead of duplicating the truncation logic, export flo_to_i from
   numeric.c and call it from the ZJIT helper, keeping the
   implementation centralized.

The new rb_zjit_flo_to_i wrapper in zjit.c delegates directly to
flo_to_i, so there is no deviation from the Float#to_i semantics.

Add FloatToInt HIR instruction that truncates a Flonum to Integer
via rb_jit_flo_to_i with GC preparation. The helper uses trunc()
for truncation toward zero, then returns Fixnum (LONG2FIX) or
Bignum (rb_dbl2big) depending on magnitude.

rb_jit_flo_to_i is a new JIT helper in jit.c, following the same
pattern as rb_jit_fix_div_fix for wrapping a static C function.

Make zjit.h the single source of truth for the JITFrame struct layout.
Remove the manual #[repr(C)] definition from jit_frame.rs and replace
it with a type alias to the bindgen-generated zjit_jit_frame.