word_source: repair DECAY-RATE@ overflow guard and remove dead shadowed registrations

DECAY-RATE@ (physics_freeze_words.c) pushed to the data stack with no
capacity check and no prior pop to make room, unlike its neighbors in
the same file -- the one live, unconditional missing-guard bug the
Isabelle sweep's ~15 candidate findings reduced to once checked against
vm_push()'s real internal bounds check (see proof/FINDINGS.md SS2).

Removed dictionary_manipulation_words.c's [ ] STATE and defining_words.c's
DEFER IS DEFER@ (plus the now-orphaned defining_runtime_defer helper) --
all confirmed permanently shadowed by later dictionary registrations
(defining_words.c and defer_words.c respectively), per FORTH's
newest-first lookup. No behavior change: the removed code was already
unreachable.

Verified: hosted `make` builds clean under -Wall -Werror; the hosted
self-test suite passes 965/965 implemented tests with no regressions.
Three-architecture QEMU acceptance boot, all clean to ok> with an
identical dict_hash=0x24b4279f0670aa3a across amd64/aarch64/riscv64 and
identical 1003/965/0/0 test totals -- logs attached.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Framebuffer_Words.thy

@@ -22,13 +22,14 @@ begin
    accessors with no vm_state counterpart, the same class of gap as every
    other hardware-boundary word in this console-fabric group.
 
-   ── Finding: FB-WIDTH/FB-HEIGHT have no overflow guard ──────────────────
-   Neither checks `ds_full` (or any capacity condition) before pushing --
-   same hazard class as physics_freeze_words.c's DECAY-RATE@, the first
-   instance of this sweep finding a missing overflow guard. Second
-   instance now, both in diagnostic/hardware-boundary words that read as
-   "just returns a number" and evidently didn't get the same underflow-
-   guard-writing discipline as stack-manipulation words.
+   ── CORRECTED finding: FB-WIDTH/FB-HEIGHT are NOT missing a guard ───────
+   Both push via C's `vm_push()` (src/stack_management.c:75), which bounds-
+   checks internally (`if (vm->dsp >= STACK_SIZE - 1) ...`) before every
+   write -- this file's earlier claim that neither checks capacity was a
+   gap in this theory's abstract push model, not a real defect in the C.
+   Re-verified 2026-08-14 during the sweep's repair pass; see
+   proof/FINDINGS.md §2 for the full correction across all files this
+   pattern was raised against.
    ======================================================================== *)
 
 (* ── PLOT ( x y color -- ) : hosted build ─────────────────────────────── *)
@@ -67,7 +68,10 @@ lemma plot_kernel_not_modelled: True
   by simp
 
 (* ── FB-WIDTH / FB-HEIGHT ( -- n ) : hosted build ─────────────────────── *)
-(* C: hosted branch pushes 0 unconditionally, no capacity guard at all. *)
+(* C: hosted branch pushes 0 via vm_push(), which bounds-checks internally
+   (see corrected header finding above) -- the abstract push below still
+   models an unconditional push since this theory's stack has no depth
+   bound to violate, but the real C is guarded. *)
 
 definition forth_fb_width_hosted :: "vm_state \<Rightarrow> vm_state" where
   "forth_fb_width_hosted vm = vm\<lparr>data_stack := 0 # data_stack vm\<rparr>"