perf(inline): allow inline-safe intrinsics in callee bodies

`classify` rejected any callee carrying an internal `Call`, even
direct calls into an inline-safe `Intrinsic` (`Sqrt`, `Fabs`,
`Fma`, `Sin`, `Cos`, `Pow`, `Log`, `Exp`, …). The infrastructure
to detect these was already in place — `is_inline_safe_intrinsic`
lists them and `callee_contains_inline_safe_intrinsic` checks for
them — but the helpers were only wired into stats attribution,
never into the classifier itself.

The compounding effect on `bench_nbody_ref`: `advance(...)` calls
`sqrt(d2)` inside the j-loop. The classifier saw the sqrt call,
returned `Unsupported`, and `main`'s 10 M-iteration `advance(...)`
call site never inlined. The j-loop body stayed opaque to LICM,
auto-vectorize, and the rest of the HIR fixed point; LLVM only
saw a hot call boundary.

Bench impact (macOS aarch64, `--no-cache`):
  mandelbrot:  ~410 ms → 315 ms  (-23 %)
  nbody:       ~1720 → 1581 ms   (-8 %)
  nbody_ref:   ~575 → 566 ms     (within noise — LLVM was already
                                  inlining advance via its own IPA)
  fib / inlined / free_function_call: unchanged within noise

Mirrored in `classify_recursive` (the relaxed classifier used by
the depth-1 recursive inliner) so callees admitting sqrt-style
intrinsics also become recursive-inline candidates.

Author: darmie

crates/compiler/src/inline.rs

@@ -451,6 +451,13 @@ fn classify_recursive(callee: &HirFunction, self_id: HirId) -> CalleeClass {
                     // Direct self-call — fine. Becomes the depth-1
                     // residual after inlining.
                 }
+                HirInstruction::Call {
+                    callee: HirCallable::Intrinsic(i),
+                    ..
+                } if is_inline_safe_intrinsic(*i) => {
+                    // Inline-safe leaf intrinsics (Sqrt, Fabs, Fma,
+                    // …) — same rule as the standard classifier.
+                }
                 HirInstruction::Call { .. }
                 | HirInstruction::IndirectCall { .. }
                 | HirInstruction::Atomic { .. }
@@ -748,12 +755,28 @@ fn classify(callee: &HirFunction) -> CalleeClass {
     }
 
     // Universal per-instruction safety check across every block.
+    // The `Call` arm permits one specific shape: direct calls into
+    // an inline-safe `Intrinsic` (`Sqrt`, `Fabs`, `Fma`, `Sin`,
+    // `Cos`, `Pow`, …) — these are leaf hardware-or-libm ops, not
+    // user functions, and admitting them is what lets the inliner
+    // take callees like `advance` from `bench_nbody_ref` (which
+    // calls `sqrt` in the hot loop). Without this admission,
+    // `main`'s 10 M-iteration `advance(...)` call site never
+    // inlines, the j-loop stays opaque to LICM / vectorisation,
+    // and Cranelift / LLVM eat the call-frame overhead 10 M times.
+    // Every other `Call` shape (free function, indirect, trait
+    // method) still bails because the callee body would need its
+    // own inlining or vtable resolution.
     let mut total_insts = 0usize;
     let mut callee_has_alloca = false;
     for block in callee.blocks.values() {
         total_insts += block.instructions.len();
         for inst in &block.instructions {
             match inst {
+                HirInstruction::Call {
+                    callee: HirCallable::Intrinsic(i),
+                    ..
+                } if is_inline_safe_intrinsic(*i) => {}
                 HirInstruction::Call { .. }
                 | HirInstruction::IndirectCall { .. }
                 | HirInstruction::Atomic { .. }