ERR/E1.8: path-sensitive value-slot liveness check

A `v, err := failable()` destructure now binds the value slot(s) "live
only where `err` is proven absent". Reading `v` where the compiler cannot
prove `err == null` is a compile error.

New diagnostic-only Pass 1e (`checkErrorFlow` in ir/lower.zig): a
structured, path-sensitive walk over each main-file function body. A
proven-null set is threaded across branches and joined by intersection
at each `if`'s merge. Proof shapes recognized:

  - `if !err { … v … }`           (proven inside the guard)
  - `if err { return/raise } … v` (proven on the fall-through)
  - `if err { … } else { … v … }` (proven in the else branch)
  - `!err and <reads v>`          (short-circuit refinement)

Error-set tag compares (`if err == error.X`) prove nothing about
absence — they narrow the tag only. Nested lambdas are analyzed as their
own boundaries. Library modules are trusted (skipped).

Migrated the canon value-failable examples (1011/1012/1018/1044) to read
their value slots under `if !err` guards — output unchanged. New
regressions: 1046 (every proof shape compiles + runs, exit 210) and 1047
(unproven reads rejected, exit 1).

Gates: zig build, zig build test, run_examples.sh -> 338 passed, 0 failed.

examples/1011-errors-value-failable.sx

@@ -19,9 +19,10 @@ parse :: (n: s32) -> (s32, !E) {
 main :: () -> s32 {
     r : s32 = 0;
 
+    // The value slot is live only where the error is proven absent (ERR E1.8):
+    // read `v1` under an `if !e1` guard, not after a bare tag-compare.
     v1, e1 := parse(5);                  // success → v1 = 50, e1 = no error
-    if e1 == error.Bad { r = r + 1000; }  // false
-    r = r + v1;                           // +50
+    if !e1 { r = r + v1; }                // success → +50
 
     v2, e2 := parse(-1);                 // Bad
     if e2 == error.Bad   { r = r + 7; }   // true  → +7