feat: local call/return detection with context-sensitive resolution

[DaniPopes]

Adds a private call/return detection pass that resolves dynamic jump targets
using context-sensitive call-string analysis, integrated into the block analysis
fixpoint.

What

The pass detects two patterns in each basic block:

• Private function call: a static JUMP (adjacent PUSH+JUMP) where the block
  also pushes a valid JUMPDEST label that survives to exit — the label is the
  return address, and the static target is the callee.

• Private function return: a dynamic JUMP whose operand has entry-stack
  provenance (passed by the caller, not computed in-block from
  memory/storage/arithmetic). Detected via a lightweight stack provenance
  simulation that tracks whether each value originated from the block's
  entry stack or was produced locally.

A worklist-based traversal over (block, call-string) pairs then traces which
callers push which return addresses, resolving return jumps to their
continuation targets (single or multi-target).

How it integrates

Instead of committing resolutions as a separate pre-pass, the PCR results are
fed as seed edges into the abstract interpreter's fixpoint. This lets the
fixpoint propagate abstract states along return edges, discovering additional
resolutions it couldn't find on its own. PCR resolutions that the fixpoint
can't independently confirm are used as fallback targets, subject to the
existing invalidate_suspect_jumps soundness check.

Pipeline: static_jump_analysis → mark_dead_code → rebuild_cfg → block_analysis (includes PCR) → mark_dead_code → dedup → rebuild_cfg → sections

Results

Full resolution stats across all benchmarks:

BENCHMARK                  LOCAL NONADJ    PCR  FIXPT  UNRES      TOTAL
---------                  ----- ------    ---  -----  -----      -----
fibonacci                      2      0      0      0      0          2
fibonacci-calldata             2      0      0      0      0          2
factorial                      2      0      0      0      0          2
counter                       11      0      0      0      0         11
snailtracer                  502     17      3      0     62        564
weth                          55      0      1     11      0         66
hash_10k                       6      0      0      2      0          8
erc20_transfer               114      0      7      0     18        132
push0_proxy                    1      0      0      0      0          1
usdc_proxy                    54      0      7     14      0         68
fiat_token                   452      6     29      0     68        520
uniswap_v2_pair              257     30     13      0     37        294
univ2_router                 474     27     22     27      0        501
seaport                     1026     39     11      0    153       1179
airdrop                      217      7      8      0     35        252
bswap64                       14      0      0      0      0         14
bswap64_opt                    8      0      0      2      0         10
eip4788                        4      0      0      0      0          4
eip2935                        4      0      0      0      0          4
curve_stableswap             176      5      4      0     13        189

weth, usdc_proxy, and univ2_router are now fully resolved (0 unresolved). PCR
enables the fixpoint to discover additional resolutions it couldn't find on
its own by seeding return edges into the abstract interpreter.

Soundness

• Return blocks require entry-stack provenance for the jump operand:
  a lightweight stack simulation tracks whether each value originates from the
  block's entry stack or was produced locally by computation/memory/storage.
• Return blocks exclude unsafe opcodes (TLOAD/TSTORE, CALL-family, CREATE-family,
  RETURN, REVERT, STOP, INVALID) to prevent false positives on shared utility
  blocks.
• Private-call detection excludes multi-target and invalid jumps (where
  term.data is not a valid callee).
• PCR hints are discarded entirely if PCR traversal does not converge.
• PCR resolutions remain subject to invalidate_suspect_jumps: if unresolved
  Top jumps exist, any resolution in a suspect block is invalidated.
• Bounded call-strings (depth 8) can under-approximate return targets; the
  invalidation check catches these cases.
• Also fixes a pre-existing bug where has_dynamic_jumps counted dead-code
  jumps (added recompute_has_dynamic_jumps()).
• All 920 tests pass including all Ethereum state tests.

[codspeed-hq]

Merging this PR will degrade performance by 74.2%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
❌ 5 regressed benchmarks
✅ 63 untouched benchmarks

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	airdrop/compile/translate	17.7 ms	21.4 ms	-17.12%
❌	fiat_token/compile/translate	57.4 ms	71.4 ms	-19.62%
❌	uniswap_v2_pair/compile/translate	26.8 ms	31.9 ms	-16.03%
❌	univ2_router/compile/translate	50.8 ms	196.7 ms	-74.2%
❌	usdc_proxy/compile/translate	5.5 ms	7.6 ms	-28.38%
⚡	weth/compile/jit	543.5 ms	379.8 ms	+43.11%

---

_{Comparing dani/local-jump-resolution (91bc0d8) with main (013cfe1)}