refactor: centralize libc declarations, move '&' concat into StringHandler

CodeGen declares its own MallocFunc in SetupExternalFunctions and uses
it for char->STRING coercion and INPUT STRING buffers, removing two bare
getFunction("malloc") calls that null-deref'd if no handler happened to
declare malloc first. The CHR branch reuses the char->STRING coercion
path instead of a second hand-rolled heap wrapper.

String concatenation moves from ArithmeticHandler (which re-declared
four externs per '&' and was the LLVM 19 build-pin root cause) to
StringHandler::emitConcat; ArithmeticHandler no longer touches the
Module. Dead FreeFunc declarations removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2 files changed, 10 insertions, 5 deletions

diff --git a/AGENTS/ARCH.md b/AGENTS/ARCH.md
index a23297b..cad017f 100644
--- a/AGENTS/ARCH.md
+++ b/AGENTS/ARCH.md
@@ -34,9 +34,10 @@ Facts about the driver (`tools/driver/main.cc`) that break naive automation:
   `verifyModule`, so invalid IR flips the exit code too. Check the exit code — do not
   grep stderr.
 
-Build pin: **LLVM 18 only.** LLVM 19 breaks compilation (`ArithmeticHandler.cc` uses
-`llvm::Module` methods relying on LLVM 18's transitive `#include`; fix would be adding
-`llvm/IR/Module.h`).
+Build pin: developed and tested against **LLVM 18**. (The historical LLVM 19 breakage —
+`ArithmeticHandler.cc` touching `llvm::Module` through a transitive include — is gone
+now that string concatenation lives in `StringHandler`, but newer LLVM versions remain
+untested.)
 
 ## Layout
 
diff --git a/AGENTS/CONVENTIONS.md b/AGENTS/CONVENTIONS.md
index 753be57..cd1adfc 100644
--- a/AGENTS/CONVENTIONS.md
+++ b/AGENTS/CONVENTIONS.md
@@ -33,8 +33,12 @@ pseudocode types *backwards* from LLVM types (`getExprTypeInfo`, `ArithmeticHand
 **Strings are malloc'd and never freed — by design.** Every string-producing operation
 (`&`, MID/LEFT/RIGHT/LCASE/UCASE, NUM_TO_STR, CHR, CHAR/number→STRING coercion) mallocs
 a fresh buffer; string literals and BOOLEAN→STRING coercion instead return pointers to
-shared module globals, so a STRING value may alias a global. `free` is declared but has
-zero call sites. Don't "fix" leaks piecemeal; it's a global design decision.
+shared module globals, so a STRING value may alias a global. `free` is never declared or
+called. Don't "fix" leaks piecemeal; it's a global design decision. All heap-string
+operations (including `&` concatenation, `StringHandler::emitConcat`) live in
+`StringHandler`; `CodeGen` also keeps its own `MallocFunc` for the char→STRING coercion
+and INPUT STRING buffers — declared in `SetupExternalFunctions`, never fetched with a
+bare `getFunction("malloc")`.
 
 **One flat symbol namespace.** Two parallel maps in CodeGen — `NamedValues`
 (name → storage `Value*`) and `Symbols` (name → `SymbolInfo{Storage, TypeName,