Refine ILVerify permanent-home tracking for returns

Co-authored-by: jkotas <6668460+jkotas@users.noreply.github.com>

Author: Copilot

src/coreclr/tools/ILVerification.Tests/ILTests/ReturnTests.il

@@ -127,6 +127,23 @@
         ret
     }
 
+    .method public hidebysig instance int32& Return.ByRefArg_Valid(int32& i) cil managed
+    {
+        ldarg.1
+        ret
+    }
+
+    .method public hidebysig instance int32& Return.ByRefLocal_Invalid_ReturnPtrToStack(int32 i) cil managed
+    {
+        .locals init (
+            [0] int32&
+        )
+        ldarga.s    i
+        stloc.0
+        ldloc.0
+        ret
+    }
+
     .method public hidebysig instance int32& Return.InstanceFieldByRef_Valid(int32 i) cil managed
     {
         ldarg.0

src/coreclr/tools/ILVerification/ILImporter.Verify.cs

@@ -1459,7 +1459,8 @@ void ImportLoadVar(int index, bool argument)
             CheckIsNotPointer(varType);
 
             var stackValue = StackValue.CreateFromType(varType);
-            stackValue.SetIsPermanentHome();
+            if (varType.IsByRefLike || (argument && varType.IsByRef))
+                stackValue.SetIsPermanentHome();
             if (index == 0 && argument && _thisType != null)
             {
                 Debug.Assert(varType == _thisType);