riscv32: a frozen-string store to a var parameter misses the caller

Found by the Pascal cross-target differential: test_set_shortstring_value_param_copies printed var str20 : orig on riscv32. Its test-core rows checked only the first and last line, so it was green.

Resolution (2026-09-28)

EmitFrozenStoreRISCV32 loads the caller's buffer address from the cell when the destination is a by-ref parameter (lw t1, 0(t1)). The test now runs cross in test-core against a whole-output .expected generated by FPC 3.2.2 (native output was checked identical to it).