RSSA LimitCheck transfer

[Stephen Weeks]

So your approach is to keep the frontier/limit computation implicit,
but to make the two labels explicit, right?  That sounds fine to me.
This would require adding a Runtime variant to Rssa.Block.Kind.t and
making the limit check transfer look like

	     | LimitCheck of {failure: Label.t, (* of Runtime kind *)
			      kind: LimitCheck.t,
			      success: Label.t} (* of Normal kind *)

Here, the failure label goto's the success label.

This is a nice intermediate position that avoids all the complexities
of exposing frontier and limit in MACHINE.