word_source: repair DECAY-RATE@ overflow guard and remove dead shadowed registrations

DECAY-RATE@ (physics_freeze_words.c) pushed to the data stack with no
capacity check and no prior pop to make room, unlike its neighbors in
the same file -- the one live, unconditional missing-guard bug the
Isabelle sweep's ~15 candidate findings reduced to once checked against
vm_push()'s real internal bounds check (see proof/FINDINGS.md SS2).

Removed dictionary_manipulation_words.c's [ ] STATE and defining_words.c's
DEFER IS DEFER@ (plus the now-orphaned defining_runtime_defer helper) --
all confirmed permanently shadowed by later dictionary registrations
(defining_words.c and defer_words.c respectively), per FORTH's
newest-first lookup. No behavior change: the removed code was already
unreachable.

Verified: hosted `make` builds clean under -Wall -Werror; the hosted
self-test suite passes 965/965 implemented tests with no regressions.
Three-architecture QEMU acceptance boot, all clean to ok> with an
identical dict_hash=0x24b4279f0670aa3a across amd64/aarch64/riscv64 and
identical 1003/965/0/0 test totals -- logs attached.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Dictionary_Manipulation_Words.thy

@@ -37,16 +37,28 @@ begin
       (include/vm.h:431, the real per-VM STATE field actively used by
       vm.c/vm_core.c/vm_bootstrap.c/capsule_loader.c on both hosted and
       kernel builds). This static is a single process-wide variable, not
-      even per-VM: in the Tripod multi-VM fleet, EVERY VM's `[`/`]`/
-      `INTERPRET` mutates the SAME shared cell, and `STATE` pushes ITS
-      address (a bare host pointer, not a VM address) -- identical across
-      every VM instance. `vm->state_var` itself is correctly toggled
-      elsewhere in the real interpreter loop, so the dictionary-space
-      compile/interpret bookkeeping isn't broken, but these four FORTH
-      words are effectively wired to a dead, cross-VM-shared shadow
-      variable instead of the VM's own state. Modelled below using only
-      `vm_mode` (which `[`/`]` DO correctly set) -- the dead static write
-      has no vm_state counterpart and is simply omitted, not "fixed".
+      even per-VM. CORRECTED 2026-08-14 -- these four words split into two
+      different reachability classes, not one:
+      - `[`, `]`, `STATE` are permanently SHADOWED (see StarForth_Defining_
+        Words.thy's duplicate-registration finding) -- dead code, this
+        static's misuse never executes for any live VM.
+      - `INTERPRET` is NOT shadowed (defining_words.c registers no word by
+        that name at all) -- it IS live and reachable, and its body really
+        does execute `state_variable = 0;` on every call
+        (dictionary_manipulation_words.c:392) alongside the correct
+        `vm->mode = MODE_INTERPRET`. This write is functionally inert
+        (nothing on any live path reads `state_variable`, since the only
+        word that ever read it -- this file's own `STATE` -- is itself one
+        of the shadowed three above), but it is live, executing code in a
+        registered, tested word, not dead code to remove casually per
+        .claude/CLAUDE.md's "never modify a registered, tested word"
+        guidance. Reported, not touched.
+      `vm->state_var` itself is correctly toggled elsewhere in the real
+      interpreter loop regardless, so the dictionary-space compile/
+      interpret bookkeeping isn't broken by any of this. Modelled below
+      using only `vm_mode` (which `[`/`]` DO correctly set) -- the dead
+      static write has no vm_state counterpart and is simply omitted, not
+      "fixed".
    2. `dictionary_m_word_hidden`'s `#else` fallback branch (taken only if
       `WORD_HIDDEN` is undefined -- it is always defined per include/vm.h:
       181, so this branch is dead in every build configuration seen) calls