RSSA LimitCheck transfer

[Matthew Fluet]

> So your approach is to keep the frontier/limit computation implicit,
> but to make the two labels explicit, right?  That sounds fine to me.
> This would require adding a Runtime variant to Rssa.Block.Kind.t and
> making the limit check transfer look like
> 
> 	     | LimitCheck of {failure: Label.t, (* of Runtime kind *)
> 			      kind: LimitCheck.t,
> 			      success: Label.t} (* of Normal kind *)
> 
> Here, the failure label goto's the success label.
> 
> This is a nice intermediate position that avoids all the complexities
> of exposing frontier and limit in MACHINE.

I like this.  It should save the codegens from needing to create the
runtime return block, because it will be explicit in Machine.