[SizzleUnrlsd]

Summary

tryGetConstFromValue used to return the last constant stored to a slot anywhere in the function,
and it dropped every cast on the way. Three things changed its answer even though the value read
was the same:

• a store made after the read;
• a store made on one branch only;
• a cast, so (unsigned char)300 read as 300.

The result fed three things: the "appears unreachable" note on buffer overflows, the
VLA-versus-constant decision, and the local stack size.

• MemorySSA. A load now resolves only when its MemorySSA clobber, from FunctionFacts, is a
  simple store of the same type to the same pointer. That store wrote exactly the bytes the load
  reads.
• Unknown cases. A merge of several stores gives no constant, and so does a store that may only
  overlap, a call, or the function entry.
• Casts are folded with ConstantFoldCastOperand.
• Same logic as SMT. This mirrors encodeLoad in SmtEncoding.cpp.
• Reachability. Separately, isStaticallyUnreachableStackAccess now requires every edge into
  the access to be dead. One dead edge used to be enough, even when another edge reached the access.
• Callers. Reachability, AllocaUsage, StackComputation and DynamicAlloca pass a
  FunctionFacts. The callers that had none build it the first time an operand is not already a
  constant.

Diagnostic changes

The analyzer's full output was compared on every fixture, default and smt-z3 passes, against
main at 703da23. Diagnostic blocks were compared regardless of their order; see Limits.

• Existing fixtures. Three "appears unreachable" notes are gone:

  • test/bound-storage/global-array-overflow.c, the write after the loop;
  • test/coretrace-legacy/bound_index.cc:13 and :14.

  All three are accesses after a loop, where the index is 10, so they run. The old lookup read
  i = 0 and concluded that i < 10 always holds.

• Existing expectation. global-array-overflow.c listed that wrong note in its expectation.
  The fixture passed anyway, because run_test.py matches the location and the headline only.
  That line is removed, and a negative expectation now forbids the note.

• Warnings and errors. None appears or disappears on any existing fixture.

• New fixtures (6) cover:

  • a store after the read;
  • a store on one branch;
  • a truncating cast;
  • an access reached by a dead and a live edge;
  • a VLA whose size is stored on one branch, now reported as dynamic, where it was taken as
    4096 bytes;
  • a VLA whose size variable is reassigned after it, now 6 bytes, where it was taken as 100 bytes.

Verification

• python3 run_test.py --jobs=4: 2505/2505 pass at 6d7af3e. main passes 2467, and the
  difference is the new tests. The two test-only commits after it were checked on all 45 fixtures
  of test/bound-storage and test/vla, in both passes.
• Each new guard fails when it should:
  • the negative expectation in global-array-overflow.c matches the note in the 703da23 output,
    in both passes;
  • vla-size-later-store-is-not-read.c checks its detail lines (strict-expectation-details).
    With 7 bytes in the expectation it fails; without the flag, it passed.
• The new unit test testTryGetConstFromValue checks 9 cases: exact store, trunc, sext, store
  after the load, narrower load, merge, may-alias store, volatile load, entry value.
• The intermediate commit (all edges dead, old lookup) builds, passes the unit tests and fixes the
  multi-edge fixture alone.
• clang-format 20 reports no violation on the touched files.

Limits

• Constant values only. Only plain constants and casts of them resolve. A value computed by
  arithmetic (n = m + 1) stays unknown, as before.
• Reachability scope. Reachability still looks only at the branches directly into the access.
  A block reached only from dead blocks, or through a switch, is not recognized.
• Run-to-run ordering on main. On main, test/false-positive-repro/stb-like-next-code-uninitialized.c
  prints its two MultipleStoresToStackBuffer notes in an order that changes between runs. This PR
  does not touch that.