refactor!: bottom-up Maybe-based rewrite driver with a precise change flag - #155

…nge flag

Replace the bespoke 'Rewritten NoChange/Recurse/Stop' driver — which
conflated change reporting with descent control — with Maybe-based
rules: 'Nothing' means the rule did not fire, 'Just' means it rewrote.

* rewriteExpBottomUpM ('rewriteMOf subexpressions'): children are
  normalized before their parent, and a rule is re-applied to its own
  result until it no longer fires, so one pass is complete and
  idempotent, and the returned Any flag is precise by construction —
  the groundwork for replacing the whole-module Eq fixpoint oracle
  (#144). Used by the optimize rule chain and DCE (both fixpoint
  members).
* rewriteExpTopDownM stays for the two order-sensitive lowerings that
  consume a pattern from the outermost head: magicDo and
  flattenDeepBinds (a bottom-up driver would dismantle a do-chain from
  the inside, nesting one thunk per step). Their rules already computed
  a Maybe internally, so they collapse to it.
* The three over-reporting rules are honest now: the DCE Abs rule
  requires ParamNamed (fixes #145), the DCE Let rule fires only when a
  binder is actually dropped (the #149 rebuild cascade is subsumed by
  bottom-up order — the exposed body is already processed), and
  inlineLocalBindings fires only when an occurrence was actually
  substituted (a zero-occurrence substitution is a no-op).

Golden churn is minted-name renumbering only (the supply is drawn in
bottom-up order now); verified by re-diffing all 50 changed goldens
with $-suffixes normalized — the single remaining diff is a
pretty-printer line wrap. Eval oracles are untouched and pass: runtime
behavior is unchanged.

CI hung for five hours on PR #155 (run 28702999696): the 'inlines
references' test draws its binder name and inlinee reference from the
same seven-name pool, so with probability 1/7 it produces the non-GUC
shape 'let x = x in x'. Substituting x := x is a textual no-op — the
occurrence count of x never reaches zero — so the bottom-up driver's
repeat-until-Nothing re-fired inlineLocalBindings forever. The old
top-down driver applied the rule once per node visit and left
convergence to the outer Eq fixpoint, which saw identical modules and
stopped; the new driver has no such implicit backstop.

Guard the rule: a binding whose RHS references its own name is never
inlined. Besides restoring termination this also prevents the latent
capture bug of the same shape (the pasted copy's free self-reference
would be captured by the very binding it names). Under GUC the guard
never fires — a Standalone RHS cannot see its own binder — so pipeline
behavior and goldens are unchanged; only direct optimizedExpression
calls on non-GUC input are affected.

The generators of the two inlining tests now respect the non-self-
referential domain, and a regression test pins the declining behavior
('declines to inline a self-referential binding').