`headers.host.toString()` after `!Array.isArray(headers.host)` narrows a
`string | number | string[]` slot to `string | number`, and the union
toString lowering accepted the narrowed checker type but emitted the toString
node over the wider storage union. The validator rejected the non-stringable
arm as an internal compiler error (SC9001).
The lowering now retags the read to the proven union (the same checked
coercion other narrowed reads use) before the per-union ToString helper.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
