SSA CFG populate spill set in target size heuristic

[clonker]

In a next step, the heuristic should get the currently existing spill set as initial state.

• add SpilledVariables type (map of SSACFG::ValueId → slot) and thread it through the SSA stack abstraction via Stack::setSpilledVariables / spilledVariables().
• Stack::canBeFreelyGenerated becomes non-static and treats spilled values as freely materializable alongside literals, junk, and call return labels
• teach StackShuffler to honor the spill set
  • Target constructor accepts the spill set and excludes spilled values from minCount and the liveOut tail count
  • requiredInTail returns false for spilled values (rematerializable)
  • relax the "liveOut fits into target" assertion when a spill set is wired up
  • skip deep swap/dup failures when the target slot can be freely generated
• findOptimalTargetSize now iteratively retries shuffle, adding the StackTooDeep culprit to a local spill set each round; cost function penalizes spills with +1000 per spilled variable
• extend StackShufflerTest with allowSpilling / initialSpilledSet parser keys, a pre-pass to compute the spill set, reporting of spilled values in the trace, and tail-set assertions that skip spilled IDs
• few more shuffler tests related to spilling

depends a little bit on #16598 to deal with some emerging cycles. could theoretically also be stand-alone.

[clonker]

#16598 solves this