A c_ local in an inner block resets the null check of the outer c_ local with the same name (false E0908) #2006

Bug

A nullable c_ local declared in an inner block replaces the null-check state of the outer c_ local with the same name. When the inner block ends, the outer variable has already been checked, yet using it is rejected with E0908.

Found while checking PR #1993 (#1290) against the cnext-way "check everywhere" rule. NullCheckAnalyzer keeps its own scope chain of c_ variables keyed by spelling. It pushes a scope only per function (enterFunctionDeclaration), so registerNullableVariable writes the inner declaration over the outer one's entry. It never asks 1.4's IProgram.bindValue which declaration a use binds to. This is the same shape as #2004. PR #1993 doesn't touch NullCheckAnalyzer.ts (no diff against main 7d7f27158).

Reproduction (--target host)

#include <stdio.h>

void f() {
    FILE c_file <- fopen("a.txt", "r");
    if (c_file != NULL) {
        if (c_file != NULL) {
            FILE c_file <- fopen("b.txt", "r");
        }
        i32 r <- fclose(c_file);
    }
}

9:24 error[E0908]: Nullable variable 'c_file' used without NULL check

Control: rename the inner variable to c_other and the file transpiles (Generated 2 output files).

Expected

The fclose(c_file) on line 9 uses the outer c_file, which was checked on line 5, so no E0908.

Definition of done

• Null-check state is kept per declaration that 1.4 binds (IProgram.bindValue), not per spelling in the analyzer's own scope chain
• A fixture with the reproduction above transpiles and runs, and fails if the spelling-keyed chain is put back. A companion error fixture keeps E0908 for an unchecked inner c_file used inside its own block