Implement zlint rule 'returned-stack-reference'

[rockorager]

Rule: returned-stack-reference

Checks for functions that return references (pointers/slices) to stack-allocated memory.

Once a function returns and the stack frame is popped, any pointers into that frame become dangling. This leads to segfaults or undefined behavior.

Example

// Bad: returns pointer to stack-allocated array
fn getData() *[4]u8 {
    var buf: [4]u8 = .{ 1, 2, 3, 4 };
    return &buf;
}

// Good: take a buffer parameter
fn getData(buf: *[4]u8) void {
    buf.* = .{ 1, 2, 3, 4 };
}

Implementation notes

Complexity: requires control flow / data flow analysis

This needs to track which local variables are stack-allocated and whether any return path yields a pointer derived from them. This is non-trivial and even zlint marks this rule as "nursery" (early development). Would require significant analysis infrastructure beyond what ziglint currently has.

Reference

• zlint docs: https://donisaac.github.io/zlint/docs/rules/returned-stack-reference
• Category: nursery (early development in zlint)

Suggested-By: @mattrobenolt

[rockorager]

Blocked on #18 (control flow analysis infrastructure).