word_source: repair DECAY-RATE@ overflow guard and remove dead shadowed registrations

DECAY-RATE@ (physics_freeze_words.c) pushed to the data stack with no
capacity check and no prior pop to make room, unlike its neighbors in
the same file -- the one live, unconditional missing-guard bug the
Isabelle sweep's ~15 candidate findings reduced to once checked against
vm_push()'s real internal bounds check (see proof/FINDINGS.md SS2).

Removed dictionary_manipulation_words.c's [ ] STATE and defining_words.c's
DEFER IS DEFER@ (plus the now-orphaned defining_runtime_defer helper) --
all confirmed permanently shadowed by later dictionary registrations
(defining_words.c and defer_words.c respectively), per FORTH's
newest-first lookup. No behavior change: the removed code was already
unreachable.

Verified: hosted `make` builds clean under -Wall -Werror; the hosted
self-test suite passes 965/965 implemented tests with no regressions.
Three-architecture QEMU acceptance boot, all clean to ok> with an
identical dict_hash=0x24b4279f0670aa3a across amd64/aarch64/riscv64 and
identical 1003/965/0/0 test totals -- logs attached.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Keyboard_Words.thy

@@ -18,11 +18,11 @@ begin
    ── Scope ─────────────────────────────────────────────────────────────
    The fallback (non-kernel-or-wrong-arch) behaviour of all six words is
    fully modelled: every one reduces to a fixed constant push (or, for
-   ALT+TAB, a true no-op) with NO capacity guard before pushing -- the
-   third and fourth instances of the missing-overflow-guard finding first
-   raised in physics_freeze_words.c's DECAY-RATE@ (KBD-SCAN/VKBD-EVENT/
-   VKBD-DEBUG/KEY-EVENT push 1-2 cells unconditionally; KBD-DEBUG pushes
-   2). The real (matching kernel+arch) hardware-polling bodies are NOT
+   ALT+TAB, a true no-op). CORRECTED 2026-08-14: all six push via C's
+   `vm_push()` (src/stack_management.c:75), which bounds-checks internally
+   -- the earlier "no capacity guard" claim here was a gap in this theory's
+   abstract push model, not a real defect in the C; see proof/FINDINGS.md
+   §2. The real (matching kernel+arch) hardware-polling bodies are NOT
    modelled: i8042_pop_scancode/virtio_input_pop_event/
    console_fb_toggle_graphics are all raw hardware/interrupt-state reads
    with no vm_state counterpart, the same class of gap as every other