Address feedback from @atrick and @nate-chandler
- @in_cxx is handled the same way as @in in callers and @in_guaranteed
in callees (except for mutation). Fix checks in various places
accordingly.
- Emit copies of @in_cxx parameters and destroy them in thunks.
