word_source: repair DECAY-RATE@ overflow guard and remove dead shadowed registrations

DECAY-RATE@ (physics_freeze_words.c) pushed to the data stack with no
capacity check and no prior pop to make room, unlike its neighbors in
the same file -- the one live, unconditional missing-guard bug the
Isabelle sweep's ~15 candidate findings reduced to once checked against
vm_push()'s real internal bounds check (see proof/FINDINGS.md SS2).

Removed dictionary_manipulation_words.c's [ ] STATE and defining_words.c's
DEFER IS DEFER@ (plus the now-orphaned defining_runtime_defer helper) --
all confirmed permanently shadowed by later dictionary registrations
(defining_words.c and defer_words.c respectively), per FORTH's
newest-first lookup. No behavior change: the removed code was already
unreachable.

Verified: hosted `make` builds clean under -Wall -Werror; the hosted
self-test suite passes 965/965 implemented tests with no regressions.
Three-architecture QEMU acceptance boot, all clean to ok> with an
identical dict_hash=0x24b4279f0670aa3a across amd64/aarch64/riscv64 and
identical 1003/965/0/0 test totals -- logs attached.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Log_Words.thy

@@ -29,13 +29,13 @@ begin
    on vm_find_word + vm_compile_word + vm_allot -- several already-flagged
    gaps compounded in one helper).
 
-   ── Finding: three more push-only words with no overflow guard ─────────
-   LOG-ERROR/WARN/INFO/TEST/DEBUG and LOG-LEVEL@ push unconditionally with
-   no `ds_full` check -- the pattern first found at DECAY-RATE@
-   (physics_freeze_words.c) and repeated across framebuffer_words.c/
-   keyboard_words.c keeps recurring specifically in "just returns a
-   constant/global" words; worth citing log_words.c as further evidence
-   when this goes to Bob as an aggregated pattern rather than one-offs.
+   ── CORRECTED finding: LOG-* words are NOT missing a guard ─────────────
+   LOG-ERROR/WARN/INFO/TEST/DEBUG and LOG-LEVEL@ all push via C's
+   `vm_push()` (src/stack_management.c:75), which bounds-checks internally
+   -- this file's earlier claim of a missing `ds_full` check was a gap in
+   this theory's abstract push model, not a real defect in the C.
+   Re-verified 2026-08-14; see proof/FINDINGS.md §2 for the full
+   correction across every file this pattern was raised against.
    ======================================================================== *)
 
 definition LOG_ERROR_LEVEL :: cell where "LOG_ERROR_LEVEL = 0"
@@ -120,7 +120,8 @@ lemma log_level_store_target_not_modelled: True
 
 lemma log_level_fetch_not_modelled: True
   \<comment> \<open>Pushes log_get_level(), reading the same unmodelled global
-     LOG-LEVEL! writes to. No overflow guard either -- see file header.\<close>
+     LOG-LEVEL! writes to. Push is via vm_push(), which bounds-checks --
+     see corrected file header.\<close>
   by simp
 
 (* ── (do-log-N) runtime words -- NOT MODELLED ─────────────────────────── *)