proof/: add StarForth_Physics_Freeze_Words.thy (physics_freeze_words.c coverage)

6 of 9 words fully modelled (FREEZE-WORD, UNFREEZE-WORD, FROZEN?, HEAT!,
HEAT@, DECAY-RATE@), parameterised over an explicit word_id-resolution
input to sidestep the same raw-pointer name-lookup gap already flagged
for FIND -- these words are an even rawer variant (caddr is an
already-computed VM address cast straight to a host pointer, not a
parsed input-stream token). SHOW-HEAT/ALL-HEATS (stdout diagnostics) and
FREEZE-CRITICAL (21-name batch of the same FREEZE-WORD op) deferred.

Finding: DECAY-RATE@ is the only push-only word in this file (and one of
few in the whole sweep) with no data-stack-full guard before the raw
push -- a genuine overflow hazard, modelled faithfully.

proof/ROOT

@@ -24,6 +24,7 @@ session "StarForth" = "HOL-Library" +
     StarForth_Mutex
     StarForth_Transition
     StarForth_Dictionary_Heat_Diagnostic_Words
+    StarForth_Physics_Freeze_Words
     StarForth_Loop1_Heat
     StarForth_Loop2_Window
     StarForth_Loop3_Decay