Split #traverseProjection write-back from path reconstruction

[Stevengre]

Closes #1011.

Stacked on top of #999 (codex/fix-interior-mut-drop-glue).

Summary

This refactors #traverseProjection around a single stable invariant instead of accumulating more bridge rules.

After this change:

• Contexts are used only for inverse write-back reconstruction through #buildUpdate
• the forward surface place path is accumulated directly during traversal and used for #mkRef / #mkPtr
• Deref restarts traversal from the pointee, so the old pointer's update frames and accumulated path are discarded together

That removes the need to reconstruct reference/pointer projections back out of traversal contexts, which was the source of the temporary CtxRangeHead / PointerOffset round-trip behavior from #999.

What changed

• extend #traverseProjection with an explicit forward-path accumulator
• remove #projectionsFor(...) entirely
• keep CtxRangeHead(...) as an update-only inverse frame instead of letting it leak into place reconstruction
• canonicalize range/index/offset projections while traversing, rather than patching them back together afterwards
• rebuild references and pointers from the directly accumulated path instead of reverse-engineering one from write-back contexts
• drop the stale niche-enum show snapshot, since it only recorded #EndProgram plus step-count drift and no longer carried diagnostic value

Why this is the right shape

The old design mixed two different concerns in one representation:

• how to rebuild a modified aggregate/range back into its original container
• how to describe the final surface place reached by traversal for ref/pointer construction

Those are not the same problem. Once they are represented separately, the temporary bridge rules stop being necessary because CtxRangeHead and CtxPointerOffset no longer need to serve double duty.

Validation

• uv --project kmir run kdist build mir-semantics.haskell mir-semantics.llvm-library -j4
• uv --project kmir run pytest kmir/src/tests/integration/test_run_smir_random.py -v -k 'complex-types'
• uv --project kmir run pytest kmir/src/tests/integration/test_integration.py -v --timeout=600 -k 'iterator-simple or iter-eq-copied-take-dereftruncate or maybe-uninit or Ptr-offset_struct_field_read or Ptr-offset_struct_field_write or Ptr-offset_read or Ptr-offset_write'
• uv --project kmir run pytest kmir/src/tests/integration/test_integration.py -v --timeout=600 -k 'pointer-cast-zst or enum-discriminants or niche-enum'