word_source: repair DECAY-RATE@ overflow guard and remove dead shadowed registrations

DECAY-RATE@ (physics_freeze_words.c) pushed to the data stack with no
capacity check and no prior pop to make room, unlike its neighbors in
the same file -- the one live, unconditional missing-guard bug the
Isabelle sweep's ~15 candidate findings reduced to once checked against
vm_push()'s real internal bounds check (see proof/FINDINGS.md SS2).

Removed dictionary_manipulation_words.c's [ ] STATE and defining_words.c's
DEFER IS DEFER@ (plus the now-orphaned defining_runtime_defer helper) --
all confirmed permanently shadowed by later dictionary registrations
(defining_words.c and defer_words.c respectively), per FORTH's
newest-first lookup. No behavior change: the removed code was already
unreachable.

Verified: hosted `make` builds clean under -Wall -Werror; the hosted
self-test suite passes 965/965 implemented tests with no regressions.
Three-architecture QEMU acceptance boot, all clean to ok> with an
identical dict_hash=0x24b4279f0670aa3a across amd64/aarch64/riscv64 and
identical 1003/965/0/0 test totals -- logs attached.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Q48_Words.thy

@@ -28,7 +28,12 @@ begin
    `STARFORTH_PERFORMANCE`) path, consistent with this suite's general
    assumption that stack words check bounds; the fast-path variant is
    flagged, not modelled, since "no check at all" has no useful lemma to
-   state beyond "anything can happen."
+   state beyond "anything can happen." CONFIRMED 2026-08-14: repo-wide grep
+   shows `STARFORTH_PERFORMANCE` is never defined by any Makefile or
+   Kconfig target in this repo -- only referenced inside vm.h itself and
+   stack_words.c. So under every configuration this repo currently builds,
+   this file's words are on the safe path; the hazard is real but dormant,
+   contingent on a build flag nothing sets today.
 
    ── Q48 operations reused from StarForth_Q48_16.thy ─────────────────────
    q48_add/q48_sub/q48_mul/q48_div/q48_from_u64/q48_to_u64 were already