[Bug] Relax ONNX frontend passes PrimType wrapper as Range dtype for shape-derived bounds

[viiccwen]

Expected behavior

The Relax ONNX frontend should import Range successfully when one of its bounds is derived from ONNX shape operators. The generated relax.arange call should receive the underlying scalar DataType, such as int64.

Actual behavior

The Range importer reads the output dtype from start.ty.dtype. This is a Relax PrimType wrapper, while relax.op.arange expects the underlying DataType.

This can break imports when a Range bound comes from a shape-derived PrimExpr, causing the importer to take the graph-building path instead of constant folding.

Minimal pattern

Shape(x) -> Gather(axis=0) -> limit
Range(start=0, limit=limit, delta=1) -> output

Proposed fix

Pass start.ty.dtype.dtype to relax.op.arange and add a regression test covering the shape-derived bound.