[Heap2Local] Handle newly unreachable refs in cmpxchg and cast_desc_eq - #9272

`Struct2Local` rewrites expressions in a post-order walk while deferring `ReFinalize` until the end of the function walk. When an unescaping allocation flows into both a failing cast inside the `ref` operand of a `struct.atomic.rmw.cmpxchg`, `array.atomic.rmw.cmpxchg`, or nullable `ref.cast_desc_eq` and into its `expected` or `desc` operand, the inner cast is replaced with an unreachable block before the parent expression is visited. Because `ReFinalize` has not run yet, the parent's `curr->type` remains concrete while `curr->ref->type` is now `Type::unreachable`, causing `curr->ref->type.with(Nullable)` or `builder.addVar(func, curr->ref->type)` to fail assertions or produce invalid IR. Check for `curr->ref->type == Type::unreachable` in `visitStructCmpxchg`, `visitArrayCmpxchg`, and `visitRefCast`.