memtrack: a safe memory check clears an earlier violation (SD-03) #36

A memory check that finds the access safe resets the analysis result to OK, which erases any earlier violation, including one recorded by set_false_result (for example REACHABILITY). Documented as SD-03 in docs/semantic-deltas.md (PR #35).

Reproduce (links against libmap2check.a, no features):

map2check_init();
map2check_map_malloc((void *)0x1000, 16);
set_false_result(5 /* Reachability */, 1, "main");
map2check_check_load((void *)0x1000, 2, 0, 4, "main");
/* get_current_property() == None: the REACHABILITY violation is gone */

Legacy: in the C library embedded in Map2Check, every violation ends in map2check_error() → map2check_exit() → abort() (lib_old/Map2CheckFunctions.c:72-102 on origin/refactory_memory_log), so the first violation is final. For loads, the error is deferred through ERROR_DEREF and raised by map2check_check_deref (lib_old/AnalysisModeMemtrack.c:156-162, 295-300), but it is still never cleared.

Likely cause: reset_result_metadata() at the start of map2check_check_load, map2check_check_free, map2check_check_free_resolved_address, map2check_check_deref and map2check_check_mem_endprog in rust/src/ffi.rs.

Pinned today by: rust/src/ffi_tests.rs::check_load_clears_a_previous_violation_when_safe.

Acceptance criteria:

• Decide whether a later safe check may clear an earlier violation (the differential harness in Add differential tests against the C implementation #15 can settle the expected verdict).
• If not: keep the first violation, update the pinning test and SD-03 in docs/semantic-deltas.md in the same change.