Defining invariant that CachedAnalysis must hold, update PrecondElim

[MikaelMayer]

Fixes #702

Problem

PrecondElim generates WF (well-formedness) checking procedures but did not update the cached call graph. This meant any downstream transform relying on the call graph would see stale data after PrecondElim.

Solution

• Document the CachedAnalyses invariant: when the call graph is present, it must reflect the current program's procedure call structure. Transforms must update it or invalidate it.
• Add CallGraph.addLeafNode for inserting nodes with no callees (updates both callees and callers maps to keep their key sets consistent).
• Update PrecondElim to register generated precondition-WF procedures as leaf nodes in the call graph (they contain only assert/assume statements and make no procedure calls).
• Replace the manual post-transform keepSet filtering in the selective verification pipeline with a second FilterProcedures.run pass. Since CallElim maintains the call graph precisely (via decrementEdge) and PrecondElim now registers WF procs as leaf nodes with noFilter := true, the call-graph closure is accurate after transforms and FilterProcedures works correctly — no manual filtering needed.
• Extend filterProceduresPipelinePhase with a respectNoFilter parameter so both the initial and post-transform filter phases reuse the same helper.

Testing

All existing tests pass, including selective verification, NoFilterWFProc, CallElim, and InlineAssertionMetadata tests.

[MikaelMayer]

Clean, well-scoped PR. The invariant documentation is clear and the addLeafNode / addWFProcToCallGraph pattern is easy to follow. One issue: the recFuncBlock case is missing the call graph update.