fix(cfg): replay errdefers on return err from catch/else captures (closes #17)

[ericsssan]

Summary

Fixes the errdefer-at-return false negative tracked in #17.

Zig fires errdefer bodies only on returns that yield an error value. lowerReturn previously recognised just the literal return error.X shape, so a return err re-raising a captured error from catch |err| / else |err| was treated as a success return — and the errdefer body was silently dropped. That missed the textbook double-free shape:

const buf = try allocator.alloc(u8, n);
errdefer allocator.free(buf);
something(buf) catch |err| {
    allocator.free(buf);   // explicit free
    return err;            // errdefer ALSO frees buf -> double free, was MISSED
};

What changed

• src/flow/cfg.zig — added is_error_capture to LocalInfo; corrected the stale header that still listed try/catch as unmodeled (they are modeled), moving the real remaining gap (error-union returns) to the "don't model" list with a soundness note.
• src/flow/cfg_builder.zig — tag catch |err| / else |err| captures as error values, routed through the single emitCatchFork chokepoint so statement / var-decl / assign / return catch positions all benefit. New returnExprIsError recognises both literal error.X and a returned error-capture identifier; lowerReturn uses it to choose the error-path flush.
• src/flow/cfg_tests.zig — two tests (see below).

Soundness boundary (intentional)

Error-union returns (return foo() where foo returns !T) are not classified here. They may or may not be an error at runtime; flushing errdefers unconditionally would false-positive on the success path, and deciding them needs callee return-type resolution plus a success/error path fork. This is left as a documented, sound false negative (never a false positive). Flushing errdefers at a known-error return — which is all this PR does — is always correct.

Tests

• errdefer DOES fire on return err from a catch capture — asserts the errdefer (arena.deinit() → .arena_kill) is replayed exactly once on the error-return path.
• errdefer does NOT fire on a non-error return from a catch arm — FP guard: return 0 from a catch arm replays nothing.

Verified meaningful: with the fix neutered, the first test fails (expected 1, found 0) while the companion stays green. zig build + zig build test (3458 tests) pass.

Closes #17