fix(optimize): conservative invalidation for by-ref calls in match subject (#384)

[mirchaemanuel]

Summary

Fixes #384. A by-reference call used as a match subject lost its writeback for constant-propagation purposes: echo match(bump($i)) { 1 => "one", default => "other" } . "|" . $i; printed one|0 instead of PHP's one|1.

Root cause

This is an AST constant-propagation bug, not a lowering/codegen one. With --emit-ir --no-ir-opt the trailing $i is already emitted as const_i64 0, so the stale value is folded before EIR.

In src/optimize/propagate/expr.rs, propagate_expr cleared the constant environment only when expr_local_writes(&expr) returned Some(non-empty). A call expression returns None (unknown write set), and None was treated as "no writes" — so the pre-call constant $i = 0 was propagated into the read sequenced after the match. The same call in an arithmetic expression or if condition works only because statement-level side-effect clearing (env_after_expr_side_effects) invalidates across statement boundaries; within a single expression there was no invalidation.

This also contradicts the module's own documented contract: "unknown calls force conservative invalidation."

Fix

propagate_expr now clears the environment when the write set is unknown (None) as well as when it is a known non-empty set. A read sequenced after any by-reference-mutating call in the same expression therefore observes the post-call value, matching PHP.

Tests

• New regression test test_constant_propagation_match_subject_byref_writeback in tests/codegen/optimizer/constant_propagation/straight_line.rs (fails one|0 before, passes one|1 after).
• No regressions: 32 propagate unit tests, 242 optimizer codegen tests, 1093 regressions/types/callables/control codegen tests — all green.
• cargo build warning-free; git diff --check clean.