reachability scan (25.5b) and exit accounting; free() and print release what they are handed

Mem.scan() and R3D_ALLOC_SCAN=<frame> (at that frame's mark, when no function is running) walk
every heap block reachable from the program's globals - the states among them - conservatively: each
word that is a heap block's start (malloc_size says so) is followed, blocks made before tracking too.
A tracked block nothing reaches is a leak whatever a frame's totals say; they are summed by site and
printed ('alloc-scan: frame 39 - 32 bytes in 2 blocks ... reachable from no global or state', then
the sites). R3D_ALLOC_EXIT=1 runs the same scan as the program quits. A test: two records dropped in
frame 20 are the two found, the one pushed into a state is not.

The escape analysis now takes free(x) as giving x back (ES_FREED, flowing to what reached x) and a
print's argument as used up, so ludic deps --births lists only what is never given back.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

selfhost/backend/emit_head.ludic

@@ -220,6 +220,7 @@ function emit_header() -> void {
         j += 1
       }
       emith("@g_");  emith(d.s);  emith(" = internal global ")
+      if (llty(d.ty) == "ptr") { push(g_scan_roots, d.s) }   # 25.5b: where the reachability scan starts
       emith(llty(d.ty));  emith(" ")
       emith(global_init(d))
       emith("\n")